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Abstract 


Destabilization  of  adversarial  organizations  is  crucial  to  combating  terrorism.  The  adversarial 
organizations  are  complex  adaptive  systems,  which  include  different  types  of  entities  and  links  to 
perform  complex  tasks  and  evolve  over-time  to  adapt  to  changing  situations.  Both  the  complexity 
and  the  adaptivity  of  the  adversary  make  it  difficult  for  friendly  forces  to  destabilize  the  adversary 
and  to  damage  the  performance  of  the  adversary’s  organization.  The  commander  desires  to  identi¬ 
fy  the  terrorists  command  structure,  key  leader;  assess  their  capability;  and  identify  weaknesses; 
current  technologies  do  not  support  these  desires.  At  best,  the  commander  might  know  historic 
activities,  and  most  of  the  web  of  connections  among  known  terrorists. 

By  taking  a  dynamic  network  analytic  approach  and  focusing  on  how  to  identify,  reason  about, 
and  break  1)  the  adversary’s  decision  making  structure,  2)  the  likelihood  that  the  adversary  can 
engage  in  key  tasks;  and  3)  the  adversary’s  over-time  social  and  geospatial  behavior,  we  can  be¬ 
gin  to  make  headway  in  reasoning  about  this  complexity  and  adaptivity.  1  develop  four  different, 
interoperable  approaches  supporting  this  assessment  and  estimation  on  adversarial  organizations. 
These  four  approaches  analyze  different  aspects  of  an  organization,  i.e.  the  core  decision  making 
structure,  the  high  level  assessment  of  task  completion  likelihood  and  the  micro  level  simulation 
of  the  behavior  of  adversaries.  By  unifying  these  approaches,  we  can  grasp  a  complete  picture  of 
the  target  as  well  as  the  destabilization  strategies  against  it.  First,  I  estimate  the  decision  making 
structure  of  the  organization,  apply  dynamic  analysis  metrics  to  it,  and  identify  critical  terrorists 
to  be  removed.  This  decision  making  structure  is  a  trimmed  organizational  structure  expected  to 
be  the  critical  command  structure  of  the  adversaries.  Second,  1  extract  an  influence  network  for 
the  key  tasks.  This  is  an  assessment  about  the  organizational  support  for  the  adversaries’  mission. 
Third,  I  use  a  multi-agent  simulation  (JDynet)  to  analyze  organizational  change.  1  simulate  the 
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adversaries’  social  interactions  and  task  execution  behavior.  Also,  I  create  and  test  simulation 
scenarios  of  removing  key  adversaries  over  the  course  of  simulations.  This  estimates  the  damage 
that  we  can  inflict  on  the  adversarial  organization  with  interventions.  Fourth,  1  augment  a  geospa¬ 
tial  component  to  JDynet,  so  the  relocations  of  personnel  and  resources  are  included  in  the  desta¬ 
bilization  analysis.  I  use  the  geo-spatial-JDynet  to  simulate  the  strategic  intervention  effects  with 
a  joint  picture  from  adversaries’  social  and  geospatial  behavior. 

To  ground  and  demonstrate  this  research,  I  use,  primarily,  three  adversarial  organizations,  the 
terrorist  networks  responsible  for  1998  US  embassy  bombing  in  Tanzania  and  Kenya;  1998  US 
embassy  bombing  in  Kenya;  and  a  global  terrorist  network.  These  are  adversarial  organizational 
structures  including  a  task  dependency  network  for  mission  execution;  geospatial  terrorist,  re¬ 
source  and  expertise  distributions;  and  terrorist  social  networks.  I  regard  these  datasets  as  an  ob¬ 
served  target  adversarial  structure  and  provide  analyses  results  that  are  basis  for  destabilization 
strategies. 

My  research  makes  contribution  at  theoretical,  technical  and  empirical  levels.  First,  I  provide  a 
theory  of  how  to  create  a  joint  picture  from  different  organizational  and  computational  theories.  I 
create  theories  to  merge  various  existing  theories,  i.e.  merging  multi-agent  simulations  and  dy¬ 
namic  network  analysis,  dynamic  network  analysis  and  Bayesian  network,  dynamic  network 
analysis  and  decision  making  structure,  etc.  This  theoretical  advancement  provides  a  joint 
thought  and  analysis  process  about  reasoning  organizational  behavior  to  managers,  commanders 
and  intelligence  analysts.  Second,  1  develop  and  test  an  interoperable  analysis  framework  sup¬ 
ported  by  the  suggested  joint  theory.  This  analysis  framework  is  realized  by  expanding  an  analy¬ 
sis  system  (0 rganization  Risk  Analyzer),  so  that  real  world  analysts  can  apply  the  suggested 
theory  to  their  target  organizations.  Third,  I  empirically  analyze  three  adversarial  organizations  to 
demonstrate  the  usage  of  this  framework  and  the  newly  enabled  analysis  results.  For  example,  the 
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newly  enabled  analysis  approaches  estimate  Bin  Laden  considered  as  a  non-critical  terrorist  in  thB 
U.S.  Embassy  Bombing  in  Tanzania  and  Kenya  based  on  the  existing  dataset  and  approach  is  an 
actual  critical  contributor  over  the  mission  execution. 

This  unifying  theory  and  framework  for  adversarial  destabilization,  a  partially  automated  intelli¬ 
gence  analysis  capability,  1)  provide  intelligence  analysis  results  that  can  meet  the  operation  tem¬ 
po  in  the  real  world,  2)  bridge  dynamic  network  analysis  and  various  inference  theories,  and  3) 
provide  a  better  tool  that  human  analysts  may  use  to  reduce  their  time  and  cost  of  destabilization 
analysis. 
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1.  Introduction 


Adversarial  organizations  are  prolific  around  the  world.  For  instance,  terrorist  organizations  are 
globalized  (Elledge,  2003;  Urry,  2002;  Sageman,  2004),  forming  alliances  (Cragin,  2007)  and 
getting  stronger.  It  appears  that  they  are  becoming  more  complex  in  their  structures  (Elliott  and 
Kiel,  2003),  more  adaptive  to  changing  situations  (Goolsby,  2006),  and  larger  in  the  number  of 
their  organizational  elements.  Assessing  these  large,  amorphous,  and  adaptive  organization  is  dif¬ 
ficult  for  the  human  analyst,  even  those  with  extensive  subject  matter  knowledge  and  experience. 


To  counter  these  growing  adversarial  organizations,  friendly  forces,  first,  try  to  reduce  the  growth 
of,  degrade  the  performance  of,  dismantle,  or  destabilize  these  organizations.  In  this  thesis,  desta¬ 
bilization  analysis  is  a  process  of  strategizing  courses  of  action  to  induce  the  above  organizational 
destabilization  effect.  Such  strategies  should  be  built  with  careful  assessments  of  the  adversary’s 
decision-making  structure,  operational  environment  and  organizational  behavior.  Therefore,  the 
major  part  of  destabilization  analysis  consists  of  estimating  the  decision-making  structure,  under¬ 
standing  the  operational  environment,  and  reasoning  the  organizational  behavior.  Finally,  the  des¬ 
tabilization  analysis  should  include  an  estimation  of  the  impact  of  the  composed  courses  of  action 
toward  the  target  organization. 


In  industry,  this  type  of  destabilization  analysis  is  regarded  as  a  risk  analysis  of  a  company.  How 
to  appropriately  observe  and  manage  employees  if  they  do  not  exactly  follow  the  specified  work 
relations?  Would  my  company  be  better  off  or  worse  off  by  reassigning  employees  to  different 
tasks?  Would  my  company  operate  without  damage  if  some  employees  leave?  These  questions 
can  be  addressed  in  a  destabilization  analysis. 


While  destabilization  analyses  are  used  by  military  commanders,  managers,  and  policy  makers, 
traditional  approaches  are  often  limited  to  be  biased  and  not  robust.  Therefore,  the  analysis  users 
need  a  new  approach  to  perform  a  more  complete  destabilization  analysis.  Traditional  destabiliza¬ 
tion  analysts  are  often  subject  matter  experts  about  target  regions,  organizations,  religions,  mar¬ 
kets,  and  so  on.  The  analyses  from  theses  analysts  have  limitations  in  several  aspects.  First,  the 
analysis  results  are  often  qualitative  and  rarely  rely  on  a  quantitative  and  statistical  approach. 
Hence,  the  results  are  not  free  from  their  prejudices  or  their  partially  specialized  areas.  Second, 
the  organizations  of  interests  are  getting  much  more  complex,  bigger,  and  being  adapted  more 
quickly.  Therefore,  human  analysts  camiot  intuitively  analyze  the  targets  without  help  from  com¬ 
putational  analyses  and  tools.  Third,  the  traditional  analyses  take  a  long  time  to  complete  and 
cannot  meet  the  current  tempo  of  changing  situations.  Fourth,  the  traditional  analyses  cannot  han¬ 
dle  various  data,  i.e.  large  volumes  of  open  source  documents,  complex  social  networks,  etc.  Fifth, 
the  traditional  analyses  separately  perform  the  cultural,  social,  and  geographical  analyses  whose 
combinations  can  suggest  better  insights  into  the  organization.  These  limitations  motivated  the 
emergence  of  various  computational  destabilization  analysis  approaches. 
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The  emerged  computational  analysis  approaches  address  some  of  the  above  limitations.  There  are 
four  outstanding  such  approaches.  Dynamic  network  analysis  (Carley,  2006a),  decision  making 
structure  analysis  (Levis,  2005),  influence  network  analysis  (Wagenhals  and  Levis,  2007),  and 
multi-agent  simulation  (Moon  and  Carley,  2007)  have  emerged  as  the  computational  tools  that 
can  aid  analysts  in  characterizing,  assessing,  and  examining  these  organizations.  Significant  ad¬ 
vances  in  analytic  capabilities,  a  reduction  in  time  to  process  data  for  analysis,  and  he  incorpora¬ 
tion  of  various  data,  such  as  open  source  documents,  are  achieved  by  some  of  these  approaches. 
However,  these  tools  cannot  handle  the  target  organizations’  complexity  and  adaptation  in  a  com¬ 
plete  manner. 


Level  of  destabilization 
analysis 

Assessment  - 


Structure  of  an 
adversarial 
organization 


Decision  making  structure  analysis 

-  Reveal  the  core  decision  making  structure 

-  Assess  the  hidden  structure  of  the  target 


Macro  level  course  of  action 

Influence  network  analysis 

-  Estimate  the  likelihood  of  their  task 
completion 

-  High  level  destabilization  strategy  building 


Micro  level  course  of  action  _ 

Multi-agent  simulation  analysis 

-  Simulate  the  behavior  of  adversaries’ 
behavior 

-  Micro  level  destabilization  tactic,  or 
a  sequence  of  adversary  removals 


t 


Unified  course 
of  action 
And 

Assessment 
on  adversaries 


Figure  1-1  a  conceptual  destabilization  analysis 


Analyzing  an  adversarial  organization  is  difficult  because  such  organizations  are  complex  adap¬ 
tive  systems  (Elliott  and  Kiel,  2003;  Marion  and  Uhl-Bien,  2003;  Fellman  et  al,  2003).  They  are 
networks  with  many  entities  and  different  types  of  links.  Hence,  determining  the  key  personnel, 
information,  and  resources  on  which  to  intervene  is  often  beyond  the  scope  of  human  intuition 
because  of  the  diversity  and  scale  of  the  structure.  In  addition,  the  adversarial  organizations  are 
adaptive  (Basile,  2004;  Rabasa  et  al,  2006).  They  restructure  themselves  over  time  and  adjust  to 
minimize  their  risks  and  vulnerabilities  (Chagrin  et  al,  2007).  Though  we  may  build  an  interven¬ 
tion  plan  based  on  a  snapshot  of  their  structure,  it  might  be  obsolete  due  to  the  adaptive  nature  of 
the  target.  Thus,  the  objective  of  this  study  is  to  facilitate  intelligence  analysis,  to  identify  the 
weaknesses  of  the  adversarial  organizations,  and  to  decrease  the  time  needed  time  to  evaluate 
courses  of  action.  To  achieve  this,  1  have  developed,  tested,  and  illustrated  an  analytic  framework 
that  can,  given  historic  data  and  current  communication  network  data,  identify  command  struc- 
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tures  for  tasks,  assess  the  capability  of  the  organization  to  perforin  these  tasks,  and  then,  given 
these  data  points,  identify  critical  personnel  and  resources  that  serve  as  targets,.  Once  this  has 
been  completed,  one  can  then  evaluate  a  course  of  action  implied  by  the  removal  of  these  targets 
with  and  without  geo-spatial  considerations  (See  Figure  1-1  for  the  conceptual  destabilization 
analysis  framework  that  I  suggest). 


This  study  has  theoretical,  technical  and  empirical  components.  The  theoretical  focus  expands  the 
current  organization  theories  by  integrating  them  with  computational  modeling  theories.  For  in¬ 
stance,  organization  theory  has  evaluated  organizations’  structures  in  terms  of  connectedness  or 
closeness  among  entities.  Also,  these  evaluations  are  vaguely  linked  to  high-level  and  abstract 
organizational  performances,  such  as  social  capital.  However,  neither  abstract  high-level  perfor¬ 
mances  nor  relations  between  the  structure  and  the  performance  predict  organizations’  actual  task 
completion  probability.  Estimating  actual  task  performance  with  an  organizational  structure  can 
advance  the  organization  management  and  organization  behavior  fields.  This  estimation  is  possi¬ 
ble  because  this  study  integrates  the  organizational  structure  analysis  with  computational  models, 
i.e.  Bayesian  network  or  multi-agent  models. 

The  study’s  technical  approach  develops  a  new  integrated  framework  to  support  destabilization 
analyses.  This  integrated  framework  enables  us  to  drill  down,  assess  and  simulate  an  organiza¬ 
tional  structure,  and  the  framework  eventually  provides  better  destabilization  analysis  results.  The 
integrated  framework  may  seem  to  be  just  an  aggregation  of  existing  analysis  approaches  at  the 
software  level,  but  while  the  interoperability  of  the  software  is  an  outcome,  it  is  a  byproduct  and 
not  the  focus  of  this  research.  Each  key  step  is  a  dramatic  enabler  of  improved  analysis  of  terror¬ 
ist  organizations.  Being  able  to  infer  task-based  decision  making  structures  from  general  historic 
data  and  communication  networks  is  a  new  capability  that  affords  improved  identification  of  key 
actors  and  a  better  understanding  of  how  adversaries  are  organized.  Being  able  to  assess  the  or¬ 
ganizational  support  for  key  tasks  with  a  computational  model,  such  as  influence  networks,  from 
the  historic  data  and  communication  structures  affords  improved  capability  assessments  and  the 
identification  of  critical  resources  and  tasks,  reduces  the  time  needed  to  generate  influence  net¬ 
works,  and  enables  a  closer  to  real-time  evaluation  of  the  adversary.  However,  each  of  the  ap¬ 
proaches  must  first  be  extended  theoretically.  These  are  key  steps  to  identifying  courses  of  action 
for  analysis.  The  final  aspect  of  the  thesis,  the  simulation,  enables  the  analyst  to  consider  more 
courses  of  action,  faster,  and  with  less  bias.  By  extending  this  simulation  activity  to  the  geospa¬ 
tial  realm,  the  ability  of  the  resultant  analysis  to  be  actionable  has  increased. 


This  study  develops  and  expands  four  different  methods  of  analysis:  decision-making  structure 
extraction  (Kansal  et  al,  2007;  Dekker,  2002),  influence  network  generation  (Wagenhals  and  Le¬ 
vis,  2007),  multi-agent  simulation  (Schreiber  and  Carley,  2004a),  and  geo-space  enabled  multi¬ 
agent  simulation  (Moon  and  Carley,  2007a;  Moon  and  Carley,  2007b).  First,  decision  making 
structure  extraction  trims  a  given  organizational  network  to  a  core  decision  making  structure,  so 
an  analyst  can  observe  important  relations  among  the  entities.  This  trimmed  structure  can  also  be 
analyzed  by  a  standard  network  analysis  technique,  and  the  analysis  tells  the  critical  entities  to  be 
removed.  This  is  comparable  to  the  other  results  of  analysis  to  a  certain  extent.  Through  influence 
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networks  (Vego,  2006;  Wagenhals  et  al,  2003),  the  study  evaluates  the  likelihood  of  a  certain 
event  happening.  This  influence  network  analysis  describes  what  to  do  to  intervene  in  the  organi¬ 
zation  at  an  event  planning  stage  by  showing  the  level  of  organizational  supports  to  an  adver¬ 
sary’s  tasks.  Lastly,  multi-agent  simulation  and  its  geo-space  enabled  version  will  estimate  the 
impact  of  implementing  a  strategic  intervention,  such  as  entity  removals,  on  a  target  organization 
by  imitating  the  behavior  of  adversaries  (Backus  and  Glass,  2006)  and  approximating  the  devel¬ 
oping  situation  in  social  and  geospatial  dimensions.  The  four  analysis  methods  originated  from 
different  fields,  but  they  are  all  prominent  methods  applicable  to  the  destabilization  analysis.  This 
study’s  major  methodological  contribution  is  in  integrating  and  developing  these  methods  so  they 
can  be  used  as  an  integrated  framework  for  analysis  in  this  domain. 


The  study’s  empirical  contribution  is  an  analysis  of  three  terrorist  organizations.  The  organiza¬ 
tions  were  chosen  to  use  the  three  datasets  because  they  1)  have  the  necessary  components  to  ap¬ 
ply  the  introduced  approaches;  2)  are  stored  in  a  well-fonnatted  XML;  and  3)  are  about  adver¬ 
sarial  organizations.  One  is  the  terrorist  network  responsible  for  the  1998  U.S.  embassy  bombing 
in  Tanzania  and  Kenya.  The  second  dataset  is  the  terrorist  network  responsible  for  the  1998  US 
embassy  bombing  in  Kenya  (excluding  organizational  elements  related  to  the  Tanzania  bombing 
from  the  first  dataset)  (Rosenau,  2005;  Carley  and  Kamneva,  2004).  These  are  small,  but  they 
have  been  well  validated  by  subject-matter  experts.  The  third  dataset,  a  global  terrorist  network, 
is  a  collection  of  adversarial  organizations  collected  by  Computational  Analysis  of  Social  and 
Organizational  Systems  (CASOS)  center  at  Carnegie  Mellon  University  (CMU).  This  empirical 
study  applies  the  framework  to  each  of  the  datasets,  finding  their  weaknesses  and  configuring  a 
best  strategic  intervention.  This  will  illustrate  how  the  framework  can  be  used  in  real  world  ana¬ 
lyses.  This  is  a  premature  validation  analysis  in  this  framework. 


1.1.  Integrated  framework  and  potential  applications 


The  above  analysis  methods,  decision  making  structure  analyses,  influence  network  analyses, 
multi-agent  simulations,  and  geospatial  simulation  analyses  have  been  supported  by  various  soft¬ 
ware  packages.  However,  one  challenge  in  this  community  is  how  to  streamline  and  process  anal¬ 
ysis  datasets  and  results  among  the  packages.  For  example,  tools  such  as  SIAM  and  Pythia  are 
well-known  computer  programs  for  influence  network  analysis.  However,  the  influence  network 
analysts  have  to  create  their  own  influence  network  by  observing  the  complex  structure  of  the 
target  organization  and  conditions  in  performing  a  particular  task.  Also,  whereas  there  are  various 
social  network  analysis  programs,  few  support  the  trimming  of  a  network  to  uncover  the  decision¬ 
making  structure  of  an  organization.  Then,  decision-making  structure  analysts  have  to  create  the 
target  decision-making  structure  without  any  help  from  the  observed  target  social  network.  This  is 
like  a  broken  analysis  chain  that  the  analysis  community  tries  to  make  seamless.  Therefore,  there 
is  a  growing  demand  to  deliver  an  integrated  and  interoperable  analysis  suite  that  prepares  inputs 
to  other  key  software  packages,  integrates  the  output  of  the  analysis,  and  implements  various 
analysis  approaches.  This  study  explores  creating  such  an  analysis  suite  by  supporting  the  intero¬ 
perability  of  outside  analysis  packages  and  incorporating  various  types  of  analysis  results  to 
create  a  summary  analysis  result. 
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1.2.  Illustration  of  usages  of  integrated  framework 


We  can  gain  greater  value  by  integrating  the  approaches  that  have  not  been  used  in  such  a  manner. 
This  section  provides  three  scenarios  for  how  analysts  can  find  the  value  of  this  framework  and 
why  the  value  is  coming  from  the  integration  of  analysis  approaches.  These  scenarios  are  not 
limited  to  the  adversarial  organization  analysis  because  the  two  scenarios  included  herein  are  de¬ 
signed  to  show  how  this  destabilization  framework  can  be  applied  to  the  management  of  global 
enterprises  and  the  open  source  development  community.  The  section  also  shows  how  organiza¬ 
tion  theory  can  be  used  with  network  analysis  to  generate  the  beginnings  of  a  theory  of  task 
through  task-based  reasoning  capabilities.  The  investigators  of  these  organizations  can  be  manag¬ 
ers,  commanders,  or  human  analysts  who  want  to  understand  their  operational  structure,  organiza¬ 
tional  support  of  tasks,  and  changes  over  time.  Therefore,  the  investigators  could  be  the  general 
managers  of  an  organization,  not  limited  to  human  analysts  interested  in  adversarial  organizations. 


Scenario  1.  The  Center  of  Computational  Analysis  on  Social  and  Organizational  Systems 
(CASOS)  at  Carnegie  Mellon  University  produced  a  global  terrorist  network  dataset  that 
is  an  aggregate  of  multiple  relational  datasets.  These  networks  come  from  network  text 
analyses,  subject  matter  experts,  databases,  and  so  on.  One  problem  is  that  the  dataset  in¬ 
cludes  a  huge  number  of  irrelevant  people  and  events,  so  the  analysts  have  to  find  out 
who,  what,  or  where  the  focuses  of  investigation  should  be.  While  the  analysts  have  to 
limit  the  investigation  scope  to  a  set  of  relevant  people,  they  also  have  to  produce  a  mod¬ 
el  describing  the  impact  of  the  friendly  forces’  interventions  as  well  as  a  forecast  of  the 
evolution  of  this  terrorist  organization.  The  analysts  must  estimate  how  the  operational 
environment  of  friendly  forces  or  adversaries  will  change  if  leaders  are  captured  or  sabo¬ 
tage  affects  their  resources  or  hinders  their  missions.  Additionally,  the  analysts  hope  to 
discover  detailed  action  plans  over  a  period  of  time,  such  as  when  one  side  acts  to  remove 
another.  This  detailed  action  plan  should  be  incorporated  with  estimations  of  organiza¬ 
tional  performance  of  the  adversaries. 


Scenario  2.  Imagine  a  global  investment  bank.  Its  organizational  chart  is  a  tree-like  hie¬ 
rarchy,  in  which  employees  belong  to  a  division  .  However,  some  employees  (e.g.  those 
deployed  to  the  Hong  Kong  branch  working  on  an  IT  project  in  the  financial  sector  and 
belonging  to  the  financial  division)  have  multiple  superiors  to  whom  they  report  (e.g.  the 
managers  in  the  Hong  Kong  branch,  IT  project  and  financial  division).  Additionally,  the 
bank  has  employees  with  different  types  ad  levels  of  expertise.  To  perform  their  analyti¬ 
cal  tasks,  the  employees  with  diverse  expertise  should  work  together.  The  CEO  of  this 
bank  needs  an  assessment  of  this  organization  from  any  different  perspectives  and  asks 
whether  the  organizational  chart  supports  the  actual  work  relations  effectively  and  how  to 
change  the  operational  structure  to  facilitate  informal  yet  important  and  efficient  work  re¬ 
lations.  He  also  wants  to  evaluate  the  operational  environment  of  this  bank  in  terms  of  lo¬ 
gistical,  personnel,  information,  and  resource  supports.  Finally,  he  needs  to  evaluate  the 
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impact  of  employees’  resignations  and  the  subsequent  loss  of  resources  or  information  on 
the  organization’s  performance. 


Scenario  3.  Managing  an  open  source  development  team  is  another  potential  application 
for  this  framework.  These  types  of  organizations  do  not  have  an  operational  organiza¬ 
tional  chart,  and  even  the  boundary  of  membership  is  often  unclear.  To  analyze  these  or¬ 
ganizations,  we  need  to  identify  the  active  members  and  the  relationships  among  them. 
Since  the  members  are  not  formally  organized,  it  is  unlikely  that  they  would  be  appro¬ 
priately  and  efficiently  assigned  to  the  tasks  in  a  way  that  maximizes  a  team’s  success. 
Thus,  it  is  important  to  evaluate  the  personnel  assignments,  who  will  code  this  with  what 
expertise  and  why,  and  task  distribution,  who  will  debug  these  errors  with  which  previous 
implementation  assignment  and  why.  Finally,  the  researchers  in  this  domain  are  often  in¬ 
terested  in  knowing  how  the  team  will  evolve  over  the  period  of  development.  This  team 
structure  evolution  will  be  driven  by  the  personal  expertise,  task  assignment,  work  rela¬ 
tions,  etc. 


The  above  three  scenarios  have  similar  analysis  questions.  First,  actual  and  significant  work  rela¬ 
tions  are  different  from  organizational  charts  while  such  actual  work  relations  are  the  focus  of 
analysis.  We  must  investigate  how  to  identify  the  actual  and  informal  work  relationships  and  how 
to  support  them  with  an  operational  structure  or  an  organizational  system.  This  is  a  critical  ques¬ 
tion  in  terms  of  organizational  management,  and  we  can  apply  the  decision-making  structure  ex¬ 
traction  analysis  to  address  this  question.  Furthermore,  when  we  take  the  organizational  struc¬ 
ture’s  evolution  into  account,  this  informal  structural  analysis  requires  more  than  decision-making 
structure  extraction.  Since  the  evolution  will  change  the  informal  work  relationships,  we  need  a 
model  to  estimate  the  structure’s  evolution  as  well  as  the  decision-making  structure  extractor.  We 
interoperate  these  two  functions  and  create  snapshots  of  inferred  structures  over  time.  This  cannot 
be  done  if  the  two  functions  are  not  interoperable,.  This  study  allows  for  this  further  analysis  by 
integrating  the  analysis  approaches. 


Second,  the  assessment  of  the  overall  operational  environment  is  always  concerned  with  the  in¬ 
vestigators  and  leaders  of  these  organizations.  How  can  they  revise  the  organizational  structures 
to  accommodate  the  task  performance?  This  can  be  analyzed  by  an  influence  network  model  that 
estimates  task  completion  likelihoods.  The  present  study’s  influence  network  generation  model 
can  expedite  such  an  analysis.  Moreover,  when  it  is  combined  with  a  multi-agent  simulation,  we 
can  generate  a  sequence  of  influence  networks  that  displays  the  increase  or  decrease  of  the  task 
completion  probability  over  time,  whose  change  is  driven  by  the  organizational  evolution.  On  the 
other  hand,  if  this  influence  network  analysis  is  used  with  the  decision-making  structure  extrac¬ 
tion  technique,  it  will  result  in  the  analysis  of  the  inferred  operational  environment,  rather  than 
the  observed  environment. 


Third,  the  estimation  of  the  evolution  of  the  organizational  performance  and  structure  is  another 
question  of  interest.  How  can  we  forecast  the  future  of  this  organization?  If  today  we  have  a  pic¬ 
ture  of  the  organization  and  the  behavior  specifics  of  the  individuals,  we  may  be  able  to  predict 
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the  evolution  path  of  the  organization.  Multi-agent  simulations  stem  from  such  an  idea.  However, 
this  is  not  the  only  use  for  of  the  simulation.  Simulations  are  another  way  to  assess  organizational 
status,  particularly  about  forecasts.  Then,  we  can  feed  the  obtained  organizational  structure  to  the 
other  approaches,  thereby  adding  the  evolution  concept  to  the  approaches. 


These  newly  enabled  approaches  are  made  possible  by  establishing  links  among  the  various  ana¬ 


lyses.  These  analyses  and  interoperation  links  are  conceptualized  in  Figure  1-2 


Figure  1-2  a  network  of  interoperable  analysis  approaches 


1.3.  Complex  adaptive  organization  and  adversarial  organizations 


Adversarial  organizations  exhibit  the  characteristics  of  complex  adaptive  system  (Mathews, 
1999).  According  to  Morel  and  Ramanujam  (Morel  and  Ramanuham,  1999),  there  are  two  com¬ 
monly  observed  characteristics  of  a  complex  system:  having  a  large  number  of  interacting  ele¬ 
ments  and  emergent  properties.  A  terrorist  network  is  a  collection  of  heterogeneous  entities  inte¬ 
racting  with  and  assigned  to  each  other  (Urry,  2002).  Though  a  terrorist  network  has  traditionally 
been  regarded  as  a  simple  human  network  (Krebs,  2002;  Mayntz,  2004),  recent  observations  and 
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analyses  assert  that  these  networks  include  resources,  information,  tasks,  locations,  and  the  hu¬ 
man  component.  Hence,  the  assignment  between  terrorists  and  tasks  or  resources  can  be  regarded 
as  an  interaction  between  two  heterogeneous  entities. 


Adversarial  organizations  are  also  adaptive.  They  evolve  over  time  and  hone  their  organizations 
to  perform  better  (Fulmer,  2000;  Goolsby,  2006)  in  their  perspective.  This  evolution  occurs  in 
two  ways,  through  knowledge  management  and  organizational  learning.  First,  an  organization 
redistributes  or  diffuses  information  or  resources  to  the  most  appropriate  personnel  as  the  organi¬ 
zation  executes  its  tasks  multiple  times.  This  can  be  seen  as  an  evolution  of  an  agent-to- 
knowledge  network  or  a  knowledge  network  (Nonaka,  1994;  Grant,  1996).  Second,  an  organiza¬ 
tion  changes  its  social  network  into  an  evolved  form  to  perform  its  tasks  or  diffuse  the  necessary 
elements  for  task  execution  (Moon  and  Carley,  2007c;  Child,  1972;  Keck  and  Tushman,  1993). 
These  two  evolutions  proceed  simultaneously  and  are  dependent  on  each  other. 


The  adaptation  in  this  work  follows  the  logic  in  JDynet  introduced  in  Chapters  7  and  8.  JDynet 
inherits  some  of  adversarial  behavior  logic  in  Construct  (Carley,  1991).  The  logic  has  been  ap¬ 
plied  and  verified  by  some  of  the  case  studies  in  the  domain  of  small  companies  (Schreiber  and 
Carley,  2004b)  and  counter-terrorism  (Carley,  2004).  On  top  of  the  Construct  behavior  model, 
this  study  adds  information  seeking  behavior  to  the  social  and  geospatial  dimensions  of  agent  in¬ 
teractions.  There  may  be  other  adaptation  logics  that  are  more  nuanced,  but  this  work  limits  the 
adaptation  of  this  logic  to  make  the  destabilization  analysis  tractable  by  not  including  all  the  poss¬ 
ible  logics. 


1.4.  Representation  of  Organizations  of  Interests:  Meta- Networks 


Because  these  organizations  exhibit  complex  systems,  we  use  the  meta-network  format  (Krack- 
hardt  and  Carley,  1998)  to  represent  and  analyze  target  organizations.  Meta-networks  are  an  ex¬ 
tended  version  of  social  network  and  include  various  types  of  nodes  and  heterogeneous  links  that 
follow  the  nature  of  complex  systems.  Basically,  it  is  a  big  adjacency  matrix  among  nodes  from 
various  types,  and  parts  of  the  adjacency  matrix  correspond  to  the  network  with  specific  interpre¬ 
tations.  For  instance,  the  adjacency  matrix  between  agents  and  agents  is  a  social  network  that  we 
ordinarily  imagine. 

1.5.  Analysis  Component  1 :  Decision  Making  Structure  Analysis 


Identifying  the  decision  making  structure  (Alberts  and  Hayes,  2006)  of  an  adversarial  group  is 
critical  when  we  attempt  to  understand,  intervene,  and  counter  the  group  (Arquilla  and  Ronfeldt, 
2001;  Kansal  et  al,  2007;  Jenkins,  2002).  However,  real  world  adversarial  decision-making  struc¬ 
tures  often  differ  from  their  known  operational  decision-making  structures,  and  sometimes  the 
members  of  the  decision  making  structure  hide  the  structure  with  various  types  of  social  interac¬ 
tions  and  communication  channels.  Furthermore,  when  we  observe  their  command  relations,  the 
dataset  is  often  noisy,  containing  misleading  and  uncertain  information.  For  instance,  the  deci- 


CMU  SCS  ISR 


-20- 


CASOS  Report 


sion-making  structure  of  a  terrorist  network  may  not  have  an  operational  hierarchy,  but  rather  a 
task  force  team  that  does  not  have  a  clear  cooperation  structure.  Also,  this  structure  is  usually 
hidden  in  friendly  civilian  communities  (Raab  and  Milward,  2003;  Allanach  et  al,  2004;  Sageman, 
2004).  The  community  may  include  individuals  who  are  not  relevant  to  the  terrorist  network  or 
their  tasks,  yet  they  have  interactions  with  each  other.  Finally,  the  nature  of  relations  among  ter¬ 
rorists  is  various  and  range  from  sharing  information  to  reporting  results  and  commanding  orders. 
If  we  could  identify  the  decision-making  structure  for  specific  tasks  from  this  wealth  of  messy 
data  we  would:  a)  have  a  better  understanding  of  who  the  local,  on-scene  leaders  are;  b)  be  better 
able  to  destabilize  the  terrorist  network;  and  c)  have  decision  making  patterns  that,  in  the  future, 
we  could  reason  against  to  determine  when  and  where  those  patterns  are  popping  up  again  in  or¬ 
der  to  prevent  future  terror  events.  To  date,  however,  the  only  approach  to  identifying  the  deci¬ 
sion-making  structure  is  to  assume  that  the  entire  communication  network  is  the  said  structure. 
As  noted,  this  is  highly  inadequate  and  overstates  the  importance  of  potentially  peripheral  indi¬ 
viduals  who  play  a  role  in  many  tasks. 


This  study  introduces  a  framework  that  largely  consists  of  two  steps  to  identify  the  decision¬ 
making  structure  of  an  adversarial  group.  First,  we  use  a  decision-making  Structure  extractor  in 
Organization  Risk  Analyzer  (ORA)  (Reminga  and  Carley,  2004)  to  extract  the  command  structure 
from  a  target  organization’s  social  network.  The  extraction  is  based  on  social  network  theories 
and  from  organization  literature  regarding  task  performance  and  group  management.  A  social 
network  has  different  types  of  social  interactions,  including  decision-making 
relationships.  .Organization  theories  provide  the  basis  of  how  to  infer  the  decision-making 
relationships  from  a  social  network.  It  can  be  argued  that  the  extracted  decision-making 
structure  provides  better  evidence  for  assessing  key  actors  to  serve  as  targets  for  destabilization 
than  does  the  entire  communication  structure. 


This  decision-making  structure  extraction  will  benefit  a  number  of  relevant  or  subsequent  analys¬ 
es.  Rabasa  et  al  (2006)  think  that  al-Qaeda  relies  more  on  loose  networks  of  operatives  to  conduct 
operations  than  before,  which  means  that  the  operatives  may  be  embedded  in  a  social  network  of 
a  community  populated  largely  by  civilians.  Although  they  co-exist  in  the  social  network,  it  is 
certain  that  the  group  needs  decision-making  activities  among  the  operatives.  Hence,  the  deci¬ 
sion-making  structure  extraction  will  reduce  or  limit  the  relevant  personnel  in  the  social  network 
and  help  set  the  scope  for  investigation  and  a  destabilization  analysis. 


1.6.  Analysis  Component  2:  Influence  network  analysis 


A  key  goal  of  counter-terrorism  analysis  is  to  prevent  future  life-threatening  events.  However, 
the  core  evidence  available  to  assess  the  capability  of  a  terror  group  is  information  on  historic 
events  and  scattered  and  incomplete  data  on  current  activities.  Influence  networks  are  the  key 
approach  for  assessing  these  capabilities.  Generating  these  influence  networks  is  generally  done 
by  subject  matter  experts  and  takes  an  immense  amount  of  time  -  weeks  and  months  are  not  un¬ 
common.  From  an  intervention  perspective,  there  is  a  need  to  do  such  analyses  more  quickly. 
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This  study  proposes  a  technique  for  generating  task  capabilities  and  event  likelihood  influenced 
networks  from  the  historic  and  network  data  automatically.  The  result  is  a  closer  to  real  time 
generation  of  data. 


An  influence  network  is  a  directed  graph  extensively  used  to  estimate  the  likelihood  for  an  Ef- 
fects-Based  Operation  (Wagenhals  et  al,  2003).  It  contains  nodes  that  represent  events  and  links 
that  encode  causal  relationships  among  events  and  propagates  the  likelihood  of  each  event 
through  promotion  or  inhibition  by  its  parents.  Influence  network  technology  is  valuable,  as 
knowing  how  to  influence  and  redirect  a  situation’s  changes  is  becoming  important.  For  example, 
influence  network  analysis  has  been  used  to  analyze  the  IED  attacks  in  Diyala,  Iraq.  The  influ¬ 
ence  network  contains  belief  statements  related  to  political,  military,  social,  economic,  informa¬ 
tion  and  infrastructure,  so  called  PMESII,  in  military  planning  (Silverman,  2007;  DARPA,  2005). 
The  network  helps  analysts  to  evaluate  in  which  sector  friendly  forces  should  act  to  lower  the  IED 
attack  frequencies  (Elufbauer  et  al,  2001).  This  approach  is  different  from  the  traditional  action- 
based  operation,  which  focuses  on  sweeping  regions,  setting  up  multiple  checkpoints,  and  ignor¬ 
ing  the  consequences  of  such  actions  from  cultural  and  sociological  perspectives  (Vego,  2006). 


In  the  terrorism  context,  personnel  sufficiency,  resource  availability,  information  accessibility, 
organizational  support,  and  so  on  are  the  belief  statements  influencing  the  completion  of  a  certain 
task.  In  addition  to  this  single  task  analysis,  these  tasks  are  interwoven  with  others  in  a  task  net¬ 
work.  Therefore,  the  result  of  a  major  and  final  task  (e.g.  bombing)  is  influenced  by  a  set  of  sub¬ 
tasks.  Thus,  the  prior  tasks  in  the  task  network  and  accompanying  belief  statements  for  each 
create  a  whole  influence  network  resulting  in  the  event  occurrence  likelihood  of  the  major  task. 
On  the  other  hand,  we  already  have  an  organization  structure  in  meta-network  format  where  we 
can  infer  the  above  task  completion  factors  and  a  task  network.  Thus,  we  create  a  function  that 
generates  an  influence  network  from  a  social  network  in  the  task  completion  assessment  perspec¬ 
tive.  This  generated  network  can  be  used  to  figure  out  which  task  or  accompanying  belief  state¬ 
ment  is  crucial  and  should  be  adjusted  in  terms  of  lowering  the  likelihood.  The  changes  resulting 
in  the  lower  likelihoods  are  the  strategies  that  friendly  forces  should  take  to  disrupt  the  target  or¬ 
ganization’s  performance. 


1.7.  Analysis  Component  3  and  4:  Multi-agent  simulation  and  its  geo-space 
enabled  version 


As  noted,  the  extraction  of  decision-making  structures  enables  improved  identification  of  key  ac¬ 
tors,  while  the  extraction  of  the  influence  networks  enables  the  identification  of  key  re¬ 
sources/tasks.  Each  of  these  key  nodes  is,  in  essence,  a  target.  A  course  of  action  would  be  to 
remove  one  or  more  of  these  targets.  Multi-agent  simulations  can  be  used  to  assess  these  alterna¬ 
tive  courses  of  action.  This  study  proposes  the  development  and  testing  of  a  multi-agent  simula¬ 
tion  for  evaluating  these  identified  courses  of  action.  While  such  multi-agent  simulations  exist, 
they  are  limited  from  a  military  perspective  as  they  do  not  consider  location.  Hence,  the  key  fo- 
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cus  here  will  be  on  how  to  include  geo-spatial  factors  and  whether  the  addition  of  this  feature 
substantially  impacts  the  results  of  the  course  of  action  analysis. 


It  is  important  to  note  that,  currently,  when  a  commander  evaluates  courses  of  action,  only  a  few 
are  evaluated.  These  evaluations  are  done  by  subject  matter  experts  discussing  the  course  of  ac¬ 
tion.  Consequently,  these  evaluations  are  prone  to  all  the  decision  biases  to  which  humans  are 
prone.  By  using  simulations,  more  courses  of  action  can  be  considered,  it  will  take  less  time  to 
consider  them,  and  the  analyses  will  be  less  biased.  As  a  result,  simulations  are  a  key  factor  in 
the  real-time  destabilization  of  terrorist  organizations. 


A  multi-agent  simulation  (MAS)  has  been  used  to  analyze  the  interactions  and  emergent  behavior 
of  a  complex  system  and  to  estimate  the  impact  of  situation  changes  in  the  system  (Moon  and 
Carley,  2006).  For  example,  an  interesting  question  for  corporate  managers  is,  “What  would  hap¬ 
pen  when  an  important  employee  decides  to  leave  the  company?”  The  managers  want  to  know 
the  impact  of  deterioration  on  the  company’s  performance  and  structure  afterward  (Schreiber  and 
Carley,  2004b).  Similarly,  some  military  officers  encounter  a  threat  scenario  and  ask  a  question, 
“What  if  we  remove  some  terrorists?”  (Moon  and  Carley,  2007d).  Based  on  the  scenario,  they  try 
to  estimate  whether  the  terrorist  network  would  respond.  To  answer  these  questions,  the  ideal  me¬ 
thod  is  to  replicate  the  target  domain  and  organization  many  times  in  the  real  world  and  to  test  the 
scenarios  in  the  replicated  environments.  Such  experiments  described  above  are  approximated  by 
the  organization  science  community  and  the  social  science  community  wherein  researchers  per¬ 
form  field  studies  or  collect  experimental  data  in  labs.  However,  these  techniques  are  very  expen¬ 
sive,  unethical,  or  impossible,  as  opposed  to  simulation  studies.  Furthermore,  there  are  many  real 
world  scenarios  that  are  too  complicated  to  replicate.  MAS  has  a  number  of  benefits.  First,  the 
feature  of  the  MAS  draws  a  nice  analogy  to  human  organizations  and  actors,  so  in  some  policy 
domains,  such  as  civil  violence  (Epstein,  2001)  or  the  transportation  of  goods  (Bergkvist,  2004; 
Louie  and  Carley,  2006),  the  MAS  is  used  (Davis  et  al,  2006;  Cohen  et  al,  1972;  March,  1991). 


This  destabilization  study  applies  an  existing  simulation  model,  JDynet,  to  a  target  organization, 
observes  the  internal  dynamics,  and  implements  virtual  experiments  with  strategic  interventions. 
Construct,  a  predecessor  model  of  JDynet,  has  been  applied  to  many  different  domains,  from  cor¬ 
porate  management  to  counter-terrorism.  Its  simulation  results  suggest  insights  into  how  informa¬ 
tion  is  diffused  and  tasks  are  performed  within  an  organization.  This  study  augments  a  geospatial 
component  to  JDynet.  This  new  version  of  JDynet  has  another  layer  for  agent  geospatial  reloca¬ 
tion  behavior  that  mimics  the  existing  agent  behavior  to  be  more  nuanced  considering  real  world 
agent  behaviors.  Especially  in  counter-terrorism  and  decision-making  structure  research,  the 
physical  location  of  entities  often  matters  because  adversarial  organizations  are  aiming  to  trigger 
events  at  specific  geospatial  locations.  Therefore,  estimating  the  whereabouts  of  the  members  and 
critical  resources  is  as  important  as  approximating  to  what  degree  a  piece  of  information  would 
be  diffused  in  a  network. 
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1.8.  Strategic  intervention  and  destabilization 


Finding  successful  tactics  (Carley,  2004;  Carley  et  al,  2002;  Morris,  2005;  Jenkins,  2002;  Cragin 
and  Gerwehr,  2005)  to  attack  a  network  is  critical  in  organizational  destabilization,  since  most  of 
our  target  organizations  are  in  network  formation.  To  elaborate  this  destabilization  effort  onto  a 
network,  we  need  to  define  two  terms:  strategic  intervention  and  the  destabilization  of  a  network. 
A  Strategic  intervention  in  a  network  means  to  intervene  in  the  existence  of  entities  or  links  of  a 
network.  For  instance,  a  node  can  be  added  or  removed,  and  so  can  be  a  link  (Borgatti  et  al,  2006; 
Albert  et  al,  2000).  While  this  addition  or  removal  may  look  as  a  simple  change  of  a  network,  in 
the  real  world,  it  can  represent  removing  an  agent,  disrupting  communication  links  through  an 
electronic  warfare,  sabotaging  a  task  or  a  resource,  or  planting  an  agent  in  a  target  organization. 
Therefore,  in  this  thesis,  most  of  the  intended  network  changes  by  outsiders  can  be  regarded  as 
interventions  on  a  network.  Particularly,  the  study  limits  the  interventions  to  the  removal  of  ad¬ 
versaries,  which  leads  analysts’  common  question,  “What  if  we  remove  this  person  from  the  or¬ 
ganization?”  he  study  creates,  evaluates,  and  optimizes  a  set  of  interventions  with  a  specific  pur¬ 
pose  that  is  network  destabilization,  thus,  such  an  intervention  can  be  seen  as  an  intervention  with 
a  strategic  intention. 


In  this  paper,  network  destabilization  refers  to  the  amount  of  damage  incurred  over  time  to  a  tar¬ 
get  organization’s  performance.  Traditionally,  destabilization  has  meant  fragmenting  a  network 
into  several  pieces  (Cohen  et  al,  2000;  Borgatti,  2003),  so  the  communication  between  entities  is 
broken.  This  study  adds  the  evaluation  of  a  group’s  performance  and  its  historic  adaptation  to  a 
given  situation  to  this  fragmentation  idea.  While  the  old  fragmentation  concept  regarded  having  a 
sparse  or  disconnected  network  as  an  indication  of  diminished  collaboration,  adversarial  organi¬ 
zations  may  intentionally  reduce  the  number  of  links  and  create  an  effective  yet  sparse  topology 
in  their  network.  This  is  particularly  true  when  an  organization  is  covert  (Carley,  2006a).  There¬ 
fore,  only  measuring  the  density  or  fragmentation  is  not  a  true  evaluation  of  destabilization  in  this 
domain.  Instead  of  measuring  fragmentation,  this  study  measures  the  number  of  completed  tasks 
by  providing  the  required  information  and  resources  to  agents,  the  accuracy  of  task  related  re¬ 
source  distribution  (Schreiber,  2006),  and  the  extent  of  infonnation  diffusion  within  a  group  (Ren 
et  al,  2001).  These  are  more  practical  metrics  coupled  with  real  world  intuition  and  more  direct 
measurements  from  a  destabilization  viewpoint.  On  top  of  these  realistic  measures,  we  can  add  an 
historic  component  for  the  following  reasons:  there  are  instances  when  friendly  forces  intervene 
in  a  target  organization  and  significantly  damage  the  target’s  task  performance,  yet  the  target  may 
be  able  to  restructure  and  rebound  its  performance.  Flowever,  in  some  other  instances,  the  target 
would  suffer  from  the  damage,  which  could  persist  for  a  long  period  of  time.  These  two  events 
should  be  measured  differently  due  to  the  temporal  differences  in  the  reaction  of  the  target. 
Therefore,  the  study  includes  historic  changes  to  track  the  rebound  performance  and/or  sustained 
damage. 


In  addition  to  the  above  fragmentation  idea,  there  are  many  different  tactics  possible  when  attack¬ 
ing  an  organization.  For  example,  recent  phishing  attacks  are  a  good  example  of  how  adversaries 
try  to  destabilize  and  manipulate  organizations  (Jagatic  et  al.,  2007).  Phishing  attacks  can  be 
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represented  as  changing  the  nature  of  links  or  planting  misinformation  in  the  links.  Therefore, 
these  interventions  are  at  the  link  level,  rather  than  the  node  level.  Furthermore,  these  interven¬ 
tions  may  be  designed  to  be  implicit,  compared  to  the  explicit  node  or  link  removal  tactics.  Ac¬ 
tually,  such  implicit  and  link-level  interventions  have  already  researched  as  the  usage  of  misin¬ 
formation  in  the  organizational  context  (Hutchinson  and  Warren,  2002;  Covacio,  2003).  This 
study  makes  some  headway  to  analyze  such  link-level  interventions  by  differentiating  the  com¬ 
munication  links  according  to  their  nature.  However,  an  overall  link-related  analysis  is  beyond 
the  scope  of  this  thesis. 

1.9.  Thesis  organization 


This  thesis  consists  of  nine  major  chapters.  Chapter  2  explains  the  concept  of  adversarial  organi¬ 
zation ,  destabilization  and  strategic  intervention.  Afterwards,  Chapter  3  describes  the  overall 
structure  of  the  analysis  framework  and  also  describes  the  datasets  used  for  in  the  empirical  re¬ 
search  in  Chapter  4.  As  the  framework  herein  is  comprised  by  four  different  approaches  (consider 
a  multi-agent  simulation  not  considering  the  geospatial  dimension  as  one  approach,  and  the  geos¬ 
patial  analysis  enabled  version  as  another  approach),  the  methods  are  introduced  in  detail  in 
Chapters  5,  6,  7  and  8.  The  method  introduction  chapters  have  been  ordered  particularly  so  that 
the  chapter  order  follows  the  natural  destabilization  analysis  flow  of  an  assessment  of  the  core 
network  of  an  adversarial  organization,  a  macro-level  intervention  strategy  and  a  micro-level  in¬ 
tervention  strategy.  After  the  chapters  about  analysis  approaches,  Chapter  9  describes  how  one 
could  use  this  new  framework  in  the  real  world.  Chapter  10  serves  as  a  concluding  document. 
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2.  Requirements  of  Integrated  Destabilization  Analysis 


Human  analysts  can  better  perform  destabilization  analysis  by  using  this  integrated  approach. 
This  integrated  approach  captures  target  organizations’  diverse  aspects.  Capturing  diverse  aspects 
is  important  because  these  aspects  can  help  generate  more  comprehensive  lists  of  key  individuals, 
resources,  expertise  or  tasks,  whose  removal  can  induce  the  destabilizing  of  the  organization. 
Thus,  in  the  first  section,  I  survey  the  key  aspects  of  an  adversarial  organization,  derive  key  re¬ 
quirements  of  the  integrated  approach,  and  find  computational  analysis  providing  means  to  ad¬ 
dress  the  requirements.  In  the  second  section,  1  define  destabilization  in  this  thesis  and  survey  the 
existing  destabilization  analysis  approaches  that  can  satisfy  the  key  requirements  identified  in  the 
first  section.  In  the  third  section,  1  summarize  which  key  adversarial  organizations’  characteristics 
and  destabilization  analysis  requirements  are  addressed  by  which  analysis  approach. 

2.1.  Critical  aspects  of  an  adversarial  organization  in  destabilization  analysis 


In  the  following,  firstly,  the  traditional  organization  theories  are  introduced.  Then,  recent  analyses 
of  adversarial  organizations  are  surveyed.  The  surveyed  recent  analyses  have  focused  on  a  few 
organizational  types,  i.e.  terrorist  networks  and  IED  networks,  and  there  are  important  characte¬ 
ristics  of  such  focused  organizational  types.  These  characteristics  are  important  factors  in  decid¬ 
ing  what  factors  the  integrated  destabilization  analysis  approach  should  be  able  to  analyze.  Final¬ 
ly,  1  derive  requirements  from  the  common  assessments. 

2.1.1.  The  nature  of  traditional  organizations  and  their  destabilization 

In  Organization  Design  (Galbraith,  1973),  Galbraith  said  that  people  believe  that  they  understand 
the  term,  organization  and  organizational  structure,  until  they  are  asked  to  define  the  terms.  Gal¬ 
braith  defines  organization  by  suggesting  a  simple  comparison.  He  compares  50  randomly  picked 
individuals  from  an  airport  to  50  individuals  from  a  football  team.  He  claims  that  the  latter  is  an 
organization  because  of  their  unified  goal,  or  an  organizational  objective,  which  the  first  group 
does  not  have.  This  claim  can  also  be  applied  to  my  problem  domain  by  saying  that  an  adversarial 
organization  is  a  group  of  individuals  with  hostile  and  unified  goals  against  friendly  forces.  For 
instance,  a  terrorist  network  should  be  a  type  of  organizations  with  a  clear  boundary  of  its  mem¬ 
bership  and  a  unified  goal.  In  deeper  theory,  this  argument  resembles  Weber  (Weber,  1978)  and 
classical  management  theorists  who  treat  an  organization  as  an  institution  to  control  individuals  in 
the  interest  of  the  organization  leaders’  goals.  If  this  definition  and  characteristic  are  true,  the  des¬ 
tabilization  effort  should  be  about  hindering  its  leader’s  command  and  disrupting  its  unified  goal 
and  accompanying  actions. 


While  the  above  definition  about  organizations  regards  the  organization  as  a  top-down  command 
passing  instrument,  there  are  other  ideas  about  the  formation  of  an  organization.  In  0 rganizations 
in  Action  (Thompson,  1967),  Thompson  argued  that  an  organization  emerges  around  pre- 
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designated  offices  when  an  event  happens.  He  illustrated  an  example  of  disaster  management.  If  a 
hurricane  hit  a  town,  an  organization  for  managing  the  disaster  will  arise.  The  disaster  manage¬ 
ment  organizations  are  formed  around  the  town  leaders  and  emergency  services,  but  the  organiza¬ 
tion  members  would  not  be  limited  to  those.  The  members  will  cooperate  with  each  other,  and  the 
cooperation  will  show  an  emerging  organizational  structure.  The  members  of  this  organization 
have  their  own  specific  goals  though  there  is  a  high  level  goal,  managing  the  disaster.  Also,  the 
operational  head  of  this  organization  would  not  be  able  to  enforce  his  will  to  the  rest  of  the  group 
because  the  structure  would  not  be  strictly  hierarchical.  He  calls  this  type  of  organizations  as  syn¬ 
thetic  organizations.  If  I  apply  this  idea  to  my  domain,  the  destabilization  will  be  much  harder 
than  the  previous  case  since  removing  the  head  would  not  relatively  affect  to  the  organizational 
behavior. 

In  The  Social  Psychological  Of  Organizations,  Katz  and  Kahn  (1966)  suggest  another  definition. 
They  define  an  organization  as  a  special  class  of  open  systems,  which  means  that  an  organization 
is  a  system  that  takes  inputs,  transforms  the  inputs,  outputs  the  transformation,  and  renews  the 
inputs.  While  they  focus  on  the  relation  between  organizations  and  organizations’  environment, 
they  also  discuss  organizational  rule  enforcement,  organizational  power  and  authority,  the  flow  of 
information,  and  the  leadership.  Organizations  enforce  roles  to  individuals,  organizations  have 
authority  structures  for  the  enforcement,  and  organizations  have  leadership  structures.  These  dis¬ 
cussions  imply  that  there  are  deeper  psychological  aspects  in  organizational  operations.  We  have 
to  identify  such  underlying  psychological  structure  and  destabilization  this  underlying  structure  to 
really  impact  the  targets. 

In  Complex  Organizations:  A  Critical  Essary,  Perrow  (1986)  think  that  an  organization  has  a 
synergic  effect  emerging  from  the  interaction  of  members.  This  synergic  effect  may  be  a  key  as¬ 
pect  of  why  the  group  members  work  together.  The  synergic  effect  enables  that  the  output  of  the 
organization  is  better  than  its  input,  which  means  that  a  work  accomplished  by  two  members 
would  be  better  than  the  combination  of  works  done  by  two  separate  individuals.  If  we  accept 
such  nature  of  an  organization,  we  must  reduce  the  synergic  effect  to  destabilize  an  organization. 
To  reduce  the  synergic  effect,  we  have  to  intervene  in  the  interactions  among  the  organizations’ 
members  because  Perrow  pointed  out  that  the  interactions  are  where  the  synergy  is  coming  from. 

In  Designing  stress  resistant  organizations,  Lin  and  Carley  (2003)  argued  how  to  create  a  robust 
organizations  that  can  withstand  stressful  situations.  In  detail,  they  enumerate  three  different 
stress  types,  such  as  external  stress,  internal  stress  and  time  pressure.  These  aspects  ask  organiza¬ 
tions  to  prepare  the  countenneasure  for  such  stresses,  and  this  leads  to  some  inefficient  structure 
to  some  extent.  Many  of  organizations  will  prepare  their  structures  against  these  threats,  and  their 
sub-optimal  structures  will  look  different  than  we  expect  from  the  ideal  organizational  structures 
in  the  context.  Furthermore,  Carley  and  Lin  (1997)  identified  information  distortion  cases  within 
an  organization.  Personnel  in  an  organization  may  suffer  from  the  information  distortion  if  1)  in¬ 
formation  is  missed,  2)  information  becomes  wrong,  3)  the  person  with  the  information  is  not 
available,  4)  a  communication  channel  breaks  down,  and  5)  the  person  with  the  information  is 
turned  over.  An  organization  may  show  adaptation  against  these  information  distortion  threats 
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and  become  more  robust  against  the  threats.  Carley  et  al  (1998)  shows  the  importance  of  the  or¬ 
ganizational  structure  from  the  organizational  performance  perspective.  They  used  simulated, 
experimental  and  archival  data  to  analyze  the  relation  between  the  structure  and  the  performance. 
Their  analysis  indicates  1 )  the  structure  partially  dictates  the  organization  performance  evolution 
and  2)  cognitive  multi-agent  social  simulations  can,  to  some  extent,  regenerate  the  observed  real 
world  organizational  performance. 


The  definitions  from  the  traditional  organization  theories  outline  the  critical  points  of  destabiliza¬ 
tion  efforts  toward  the  organizations  of  the  definitions.  1  summarize  the  findings  from  the  surveys 
below. 

•  Literature  review  finding  about  organizations  1:  If  an  organization  emerged  from  an 
event  spontaneously  around  pre-designated  offices,  the  emerging  organizations  would 
not  share  a  unified  goal.  Therefore,  only  removing  a  leader  would  not  destabilize  the 
organization. 

•  L  iterature  review  finding  about  organizations  2:  If  an  organization  has  internal  energy, 
such  as  rule  enforcement;  organizational  power  and  authority;  and  leadership,  the 
strategic  interventions  should  be  made  with  consideration  of  the  above  factors. 

•  L  iterature  review  finding  about  organizations  3:  If  an  organization  is  complex  and  col¬ 
lective,  and  if  an  organization  performs  better  than  just  sum  of  its  individual  members, 
the  destabilization  should  focus  on  decreasing  such  a  synergic  effect  of  the  group. 


2.1.2.  The  nature  of  adversarial  organizations  of  interest  and  their  destabilization 

Burton  (2003)  argues  that  there  are  three  categories  of  questions  that  we  can  ask  in  organization 
science.  We  can  ask  questions  about  ‘what  is’,  ‘what  should  be’  and  ‘what  might  be’.  Analysis  on 
the  nature  of  adversarial  organizations  is  very  close  to  asking  questions  about  ‘what  might  be,’ 
because  of  the  covert  nature  of  adversarial  organizations.  Thus,  the  following  literatures  are  most¬ 
ly  a  series  of  thoughts  about  ‘what  might  be’  with  partially  observed  evidences. 


Current  proliferation  of  terrorist  organizations  (Sageman,  2004)  has  led  analysts  to  focus  on  such 
organizations  (Stem,  1999).  Originally,  terror  organizations  have  been  existed  since  French  revo¬ 
lution  (Reich,  1990),  and  in  U.S.,  domestic  terror  organizations  (Zhou,  2005)  are  also  organiza¬ 
tions  of  interest.  However,  many  recent  analyses  concentrate  on  global  or  middle-east  terrorist 
organizations  like  al-Qaeda,  Hamas,  or  Hezbolah  (Midlarsky  et  ah,  1980).  These  global  or  mid¬ 
dle-east  terrorist  organizations  have  differences  in  their  nature  (Atran,  2008),  but  their  one  com¬ 
mon  aspect  is  that  these  organizations  are  based  on  Islam  extremism  (Stem,  2003).  1  limit  the  ad¬ 
versarial  organizations  to  these  current,  Islamic  extreme,  middle-east  concentrated  terrorist  organ¬ 
izations.  This  limitation  enables  this  work  to  be  more  focused  on  the  current  critical  issues  while 
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the  computational  approaches  are  still  applicable  to  the  other  types  of  organizations.  This  section 
shows  the  traditional  qualitative  analyses,  first,  and  the  movements  from  the  traditional  qualita¬ 
tive  analyses  to  the  recent  computational  analyses,  next. 


Traditionally,  analyses  of  these  specific  terrorist  organizations  have  been  about  three  questions: 
why  terrorism  occurs,  how  the  process  of  terrorism  works,  and  what  its  social  and  political  effects 
are  (Crenshaw,  1981).  By  answering  why  terrorism  occurs,  analysts  shape  the  terrorists’  demo¬ 
graphics  and  motivations.  Felter  and  Fishman  (2007)  survey  the  demographics  of  recruited  al- 
Qaeda  members.  Many  Saudi-national  activists  become  al-Qaeda  members,  and  many  of  them  are 
bom  around  1984  averagely.  However,  their  survey  also  reveals  large  portion  of  transnational 
recruitments.  These  surveys  are  valuable  in  designing  the  destabilization  framework  because  the 
survey  tells  that  the  framework  should  estimate  such  transnational  movements.  As  another  analy¬ 
sis  to  answer  why  terrorism  occurs,  Stem  (2003b;  2000)  identifies  the  motivation  of  terrorists 
from  five  aspects:  alienation,  humiliation,  demographics,  history,  and  territory.  Each  of  these  as¬ 
pects  invokes  the  terror  activities,  and  if  the  aspects  are  subdued,  the  activities  may  fade  away. 
This  implies  that  the  integrated  framework  should  consider  the  cultural,  the  demographic  and  the 
geographic  aspects  of  the  terrorists  and  their  organizations.  Unlike  the  above  committed  motiva¬ 
tions  and  demographics,  Grant  (2005)  has  observed  that  the  members  of  more  recent  terrorist 
networks  are  not  entirely  committed  to  their  networks  based  on  their  unified  goal,  rather  than  they 
do  their  jobs  on  an  individual  contract  basis.  In  the  recent  adversarial  organizations,  there  is  nei¬ 
ther  individual  commitment  to  their  organizations’  goals  nor  organizational  method  to  unify  the 
individual  members’  goals  into  one  goal  considering  the  observed  decentralized  structure.  Hence, 
some  analysts  say  that  a  terrorist  network  is  a  decentralized  network  with  a  single  task  oriented 
affiliation,  rather  than  an  ultimate  goal  based  affiliation. 

•  Literature  review  finding  about  adversarial  organizations  1:  The  adversarial  organiza¬ 
tions  show  multi-national  recruitments  and  trans-national  movements. 

•  Literature  review  finding  about  adversarial  organizations  2:  The  members  of  adver¬ 
sarial  organizations  have  motivations  in  alienations,  humiliation,  demographics,  histo¬ 
ry,  or  territory. 

•  L  iterature  review  finding  about  adversarial  organizations  3:  Some  terrorists  are  not  en¬ 
tirely  committed  to  their  organizations’  goals,  and  they  interacted  with  others  in  decen¬ 
tralized  forms. 

Analyses  answering  how  the  process  of  terrorism  works  are  another  major  analysis  stream.  The 
analyses  investigate  how  the  leaders  disperse  their  will  to  their  members  (Brachman  and  McCants, 
2006),  how  the  individuals  come  up  with  a  terrorist  organizations  (Stem,  2003a),  how  the  organi¬ 
zations  are  managed  (Stem,  2003b),  or  how  the  organizations  operate  and  accomplish  their  goals 
(CTC,  2007a;  CTC,  2007b;  Grant,  2005).  These  analyses  points  out  several  common  characteris¬ 
tics  of  the  organizations.  First,  the  organizations  are  very  difficult  to  observe  and  impossible  to 
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survey.  Unlike  the  organizational  studies  on  corporate  or  friendly  militaries,  these  organizations 
are  only  observable  through  their  explicit  announcements,  captured  documents  or  arrested  mem¬ 
bers.  Combating  terrorism  center  (CTC)  has  translated  their  documents  and  letters  (Brachman  and 
McCants,  2006),  and  the  center  partially  uncovered  many  important  organizational  aspects  (CTC, 
2007c),  but  these  findings  are  still  partial  and  limited.  Second,  the  organizations  are  very  adaptive. 
They  change  their  missions,  so  that  the  missions  can  be  achievable  (Stem,  2003a).  They  trans¬ 
form  their  organizational  structure  to  more  decentralized  forms,  so  that  the  structures  can  survive 
against  the  friendly  forces’  efforts  (Stem,  2003a;  McFate,  2005a;  Burke,  2004;  Hoffman,  1998). 
They  adapt  to  their  changing  operational  environments  by  relocating  their  bases  or  approaching 
locals  with  different  propagandas  (McFate,  2005a).  Third,  the  organizations  are  decentralized. 
McCants  et  al.  (2006)  drew  a  social  network  of  prominent  terrorist  individuals.  The  network  was 
a  citation  network  among  documents  related  to  terror  ideology,  strategy  and  tactics.  When  ana¬ 
lysts  observe  the  citation  network,  they  recognize  that  even  Usama  Bin  Laden  does  not  control 
every  ideology  groups. 

•  Literature  review  finding  about  adversarial  organizations  4:  Analysts  cannot  survey 
the  adversarial  organizations,  and  they  only  can  observe  the  organizations  partially. 

•  L  iterature  review  finding  about  adversarial  organizations  5:  The  adversarial  organiza¬ 
tions  are  hidden  in  social  communities  and  are  distributed  geospatial iy. 

•  L  iterature  review  finding  about  adversarial  organizations  6:  The  adversarial  organiza¬ 
tions  operate  in  cultural,  regional,  organizational  complex  environments  and  challeng¬ 
ing  situations. 

•  Literature  review  finding  about  adversarial  organizations  7:  The  adversarial  organiza¬ 
tions  are  adaptive  to  changing  their  missions,  organizational  structures,  and  changing 
operational  environments. 

•  L  iterature  review  finding  about  adversarial  organizations  8:  The  adversarial  organiza¬ 
tions  are  decentralized,  so  it  is  harder  to  infer  and  recognize  the  authority  structure 
compared  to  the  centralized,  hierarchical  organizations. 

Analyses  answering  how  to  destabilize  the  organizations  are  parts  of  answers  about  what  the  ter¬ 
rorism  activities  social  and  political  effects  are.  Only  these  destabilization  parts  are  surveyed  be¬ 
cause  these  are  very  relevant  to  this  thesis,  and  because  the  other  parts  are  more  relevant  to  the 
impact  on  friendly  organizations,  not  the  adversarial  organizations.  CTC  has  been  very  active  in 
suggesting  the  qualitative  destabilization  policy  recommendations.  CTC  (2007a)  asserts  that 
friendly  forces  should  exploit  the  cracks  among  the  al-Qaeda  leadership.  The  al-Qaeda  leaders 
have  internally  gone  through  long  struggles  and  discussions  in  setting  their  strategies  and  larger 
goals.  This  means  that  there  are  factions  in  al-Qaeda  that  can  be  fragmented  if  friendlies  exploit 
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the  chasm  between  factions.  CTC  (2007b)  analyzes  the  al-Qaeda  relocation  to  the  eastern  Africa, 
which  is  the  background  of  this  thesis’s  empirical  research.  The  analysis  includes  qualitative  pro¬ 
filing  of  individual  terrorists,  cultural  challenges  that  al-Qaeda  had  to  face,  etc.  There  is  an  inter¬ 
esting  policy  recommendation  in  this  analysis.  The  analysis  claims  that  the  friendlies  have  to 
maintain  the  interdiction  capability  against  high  value  al-Qaeda  targets.  While  this  claim  is  valid 
in  general,  there  was  no  discussion  how  to  measure  the  value  of  the  targets  except  the  qualitative 
analysis.  Another  interesting  research  about  destabilization  of  these  groups  is  the  policy  recom¬ 
mendation  made  by  a  terrorist,  Aby  Yahya  (Brachman,  2008).  He  points  out  that  friendly  forces 
should  focus  more  on  the  propaganda  war,  such  as  painting  a  bad  picture  of  jihadists  in  the  Arab 
world  or  invoking  a  fatwa  from  Islam  priests.  However,  his  destabilization  plan  is  not  close  to  any 
practical  recommendations  such  as  how  to  analyze  their  organizational  structure  or  what  to  target. 
McFate  (2005b)  is  a  qualitative  destabilization  analysis  about  1ED  attack  groups.  She  clearly  links 
the  organizational  structures  and  the  structures’  elements:  personnel,  resource  and  1ED  tasks.  She 
promotes  use  of  computational  theories  and  approaches,  i.e.  social  network  analysis.  Obviously, 
qualitative  destabilization  analysts  now  appreciate  the  necessity  of  including  quantitative  analyses. 
Furthermore,  Fishman  (2006a)  describes  the  difficulties  of  friendlies’  destabilization  efforts.  He 
discusses  the  future  of  al-Qaeda  in  Iraq  after  A1  Zarqawi’s  death.  Friendly  forces  were  able  to 
track  down  A1  Zarqawi,  to  attack  the  house  where  he  was  hiding,  and  to  remove  him.  This  report 
tells  that  the  limitation  of  friendly  forces  intervention  in  terms  of  time  and  space  because  frien¬ 
dlies  cannot  intervene  in  every  place  and  every  individuals.  Also,  the  intervention  frightens  re¬ 
maining  terrorists  since  they  acknowledge  that  friendlies  can  get  to  where  they  are.  In  this  case, 
friendlies  cannot  remove  or  interdict  any  individuals  that  they  can  act  on  because  of  possible  situ¬ 
ation  changes  after  the  action.  Friendly  forces  need  more  estimation  what  will  happen  after  their 
action.  This  estimation  may  be  qualitative  as  Fishman’s  report,  or  it  can  be  quantitative  as  the 
products  from  the  integrated  destabilization  analysis  framework. 

•  Literature  review  finding  about  adversarial  organizations  9:  Friendly  forces  should 
exploit  the  internal  disputes  of  the  adversarial  organizations. 

•  Literature  review  finding  about  adversarial  organizations  10:  Friendly  forces  should 
anticipate  transnational  movements  of  the  adversarial  organizations. 

•  Literature  review  finding  about  adversarial  organizations  11:  The  profiles  of  adversa¬ 
ries  are  important  in  destabilization  analysis. 

•  Literature  review  finding  about  adversarial  organizations  12:  The  operational  envi¬ 
ronment  of  adversaries  can  be  worsened  through  propaganda  war. 

•  Literature  review  finding  about  adversarial  organizations  13:  The  adversarial  organi¬ 
zations  composed  of  various  elements:  personnel,  expertise,  resources,  tasks,  missions, 
objectives,  beliefs,  etc.  These  various  elements  can  be  a  very  diverse  collection  of  orga¬ 
nizational  items  used  and  perceived  in  the  real  world. 
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•  Literature  review  finding  about  adversarial  organizations  14:  Some  destabilization 
analysts  mentioned  that  they  need  more  computational  approaches  such  as  social  net¬ 
work  analysis. 

•  Literature  review  finding  about  adversarial  organizations  15:  Friendly  forces  cannot 
intervene  in  freely  if  they  do  not  have  any  estimation  about  what  will  happen  after  their 
actions.  This  emphasizes  the  importance  of  effects  assessments  on  the  adversarial  or¬ 
ganization  intervention  strategies. 


Recently,  analysts  have  moved  from  the  above  traditional  qualitative  analyses  to  the  computa¬ 
tional  analyses.  These  computational  analyses  are  introduced  in  the  next  section.  There  are  criti¬ 
cal  aspects  that  the  above  qualitative  analyses  identified,  yet  the  analyses  cannot  address  fully.  On 
the  other  hand,  these  critical  aspects  can  be  addressed  by  incorporating  computational  analyses. 
The  followings  are  such  four  aspects  driving  computational  approaches  to  be  involved  in  destabi¬ 
lization  analysis  processes. [ 


ings  support  the  aspects. 


Table  2-1 


illustrates  what  the  four  aspects  are  and  what  survey  fmd- 


Table  2-1  Summary  of  identified  adversarial  organizations’  critical  aspects  requiring  computational 
analyses,  The  identified  critical  aspects  are  supported  by  literature  review  findings  from  literature 
review  of  qualitative  analysis 


Adversarial  organizations’  critical  aspect  requiring 

computational  analyses 


The  adversarial  organizations  are  decentralized  and 
loosely  coupled 


The  adversarial  organizations  are  often  hidden  in  com¬ 
munities,  and  the  organizations  hide  their  significant 
decision  making  structures 


The  adversarial  organizations  perform  complex  tasks 


The  adversarial  organizations  are  adaptive 


Supporting  literature  review  find¬ 
ings 
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First,  the  literature  review  finding  about  organization  1;  and  literature  review  finding  about  adver¬ 
sarial  organization  3,  8,  9,  and  11  support  that  the  adversarial  organizations  are  decentralized  and 
loosely  coupled  (Burke,  2004;  Hoffman,  1998).  Therefore,  it  does  not  have  a  strict  hierarchy, 
such  as  a  traditional  military  unit.  This  decentralized  organizational  structure  cannot  be 
represented  by  using  the  typical,  tree-like  organizational  chart.  Rather  than  such  an  organizational 
chart,  we  need  to  represent  the  structure  as  a  network  of  adversaries.  The  network  representation 
(Carley,  2006a;  Fellman  et  ah,  2003)  is  better  because  it  can  better  handle  flat  team  structure,  cel¬ 
lular  structure,  and  distributed  team  structure,  which  are  the  characteristics  of  adversarial  groups. 
Furthermore,  applying  the  network  representation  to  the  structure  means  that  we  can  utilize  dy¬ 
namic  network  analysis  metrics  and  algorithms  that  are  useful  in  addressing  frequent  destabiliza¬ 
tion  analysis  questions,  i.e.  which  key  personnel  or  resources  are  critical,  which  agents  are  in  the 
same  sub  group,  and  etc. 

Second,  the  literature  review  finding  about  organization  2,  3;  and  literature  review  finding  about 
adversarial  organization  1,2,4,  and  5  suggest  that  the  adversarial  organizations  are  often  hidden 
in  communities,  and  the  organizations  hide  their  significant  decision  making  structures  (Raab  and 
Milward,  2003;  Sageman,  2004).  When  we  observe  the  members  of  adversarial  groups,  the  mem¬ 
bers  interact  with  people  who  are  not  relevant  to  their  groups.  In  this  case,  we  want  to  exclude 
such  innocent  people  from  our  observations.  Furthermore,  such  organizations’  decision  making 
structures  may  have  a  task  force  team  that  does  not  have  a  clear  cooperation  structure.  Finally,  the 
adversaries’  interactions  imply  various  hidden  purposes  ranging  from  sharing  information,  or  re¬ 
porting  results  to  commanding  orders.  The  decision  making  structure  analysis  (Levis,  2005) 
community  has  researched  the  definitions  and  nature  of  different  command  and  control  relations. 
Additionally,  the  community  has  enumerated  the  possible  interaction  networks  like  information 
sharing,  result  sharing  and  command  interpretation.  Also,  it  supplies  models  to  analyze  organiza¬ 
tional  cognition  and  decision  making  processes.  Thus,  integrating  the  decision  making  analysis 
tools  would  be  beneficial  for  destabilization  analysis. 


Third,  the  literature  review  finding  about  organization  3;  and  literature  review  finding  about  ad¬ 
versarial  organization  6,  12,  13,  and  14  support  that  the  adversarial  organizations  perform  com¬ 
plex  tasks.  For  instance,  a  terrorist  network  is  a  collection  of  heterogeneous  entities  interacting 
with  and  assigned  to  each  other  (Urry,  2002;  Marion  and  Uhl-Bien,  2003).  Though  a  terrorist 
network  was  traditionally  regarded  as  a  simple  human  network  (Krebs,  2002;  Mayntz,  2004),  re¬ 
cent  observations  and  analyses  assert  that  the  terrorist  networks  include  resources,  information, 
tasks,  locations,  as  well  as  human  components.  Moreover,  the  groups’  tasks  during  an  operation 
demand  the  distributed  resources,  expertise,  information  and  personnel.  Therefore,  the  adversarial 
organization  in  fact  is  performing  very  complicated  tasks  requiring  well  considered  personnel 
deployment,  information  exchange  and  resource  deliveries.  Hence,  destabilization  analysis  should 
include  a  mean  to  assess  the  complex  operational  environments  of  the  adversaries  and  task  com¬ 
pletion  likelihood.  This  assessment  identifies  a  vulnerable  task  with  low  completion  likelihood. 
We  can  prevent  this  vulnerable  task  to  derail  the  task  dependency  network  of  adversaries. 
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Finally,  the  literature  review  finding  about  organization  1;  and  literature  review  finding  about 
adversarial  organization  1,  7,  9,  10  and  15  implies  that  the  adversarial  organizations  are  adaptive. 
They  evolve  over-time  and  hone  their  organizations  to  perform  better  (Goosby,  2006;  Fulmer, 
2000).  This  evolution  occurs  in  two  ways:  in  knowledge  management  and  organizational  learning. 
First,  an  organization  redistributes  or  diffuses  information  or  resources  to  the  most  appropriate 
personnel  as  the  organization  executes  its  tasks  multiple  times.  This  can  be  seen  as  an  evolution 
of  agent-to-knowledge  network,  or  knowledge  network  (Nonaka,  1994).  Second,  an  organization 
transforms  its  social  network  to  perform  its  tasks  or  diffuse  the  necessary  elements  for  task  execu¬ 
tion  (Child,  1972).  These  two  evolutions  proceed  simultaneously  and  are  dependent  on  each  other. 
To  estimate  such  evolutions,  we  utilize  a  multi -agent  simulation.  Multi-agent  simulations  are  ex¬ 
tensively  used  in  the  analyses  of  military  planning,  information  diffusion  or  cultural  movement. 
Given  the  decentralized  formation  of  the  adversaries,  multi-agent  simulation  is  an  appropriate 
tool  for  imitating  the  adversarial  behavior  and  the  organizational  collective  behavior. 

2.1.3.  Real  world  destabilization  cases  of  adversarial  organizations 

We  observe  the  destabilization  of  adversarial  organizations  in  direct  or  indirect  ways.  It  is  very 
rare  to  observe  the  actual  collapse  of  adversarial  organizations,  i.e.  the  Soviet  regime  collapse 
(Beissinger,  2002).  However,  these  direct  observations  were  possible  because  those  organizations 
are  overt  and  clearly  bounded,  and  these  organizations  are  not  in  my  research  scope.  Since  the 
adversarial  organizations  in  my  research  scope  is  more  covert,  complex  and  fuzzy-bounded,  such 
a  direct  destabilization  observation  is  not  possible. 


What  we  can  notice  from  the  destabilization  of  the  adversarial  organizations  are  indirect  effects 
toward  the  security  of  friendly  forces  and  civilians.  For  example,  we  can  see  the  increase  or  de¬ 
crease  of  the  IED  attack  frequencies,  the  number  of  terrorist  activities,  or  proliferation  of  internet 
sites.  If  we  are  successful  in  destabilizing  their  organizations  by  disrupting  their  decision  making 
procedures,  operational  environments,  or  actual  operation  execution  process,  such  attack  inci¬ 
dents  or  attempts  should  occur  less  frequently.  After  the  death  of  Hamas’s  founder  and  leader, 
Yassin,  Hamas  did  not  become  destabilized;  rather  Hamas  enjoyed  a  victory  from  Palestinian  par¬ 
liamentary  election  (Malka,  2005).  In  spite  of  A1  Zarqawi’s  death  (Washington  Post,  2006),  who 
is  believed  to  be  the  leader  of  al-Qaeda  in  Iraq,  the  IED  attacks  in  Iraq  did  not  diminish  (Riedel, 
2007).  Byman  (2003)  even  argues  that  the  death  of  A1  Zawahiri  or  Bin  Laden  might  not  destabil¬ 
ize  al-Qaeda’s  operation. 


On  the  other  hand,  the  destabilization  history  of  IRA  (Moloney,  2002)  may  be  an  insightful  ex¬ 
ample  to  our  current  situations  dealing  with  al-Qaeda,  Hezbollah,  or  Hamas.  IRA’s  most  of  polit¬ 
ical  wings  are  now  inactive  after  the  Northern  Ireland  peace  process  (Wikipedia,  2008).  Over  the 
course  of  the  peace  process,  the  IRA  operational  environment  became  hostile.  At  the  end  stage,  a 
small  incident  finished  the  operation  of  IRA.  A  bar  fight  between  a  civilian  and  an  IRA  member 
resulted  in  the  civilian’s  death,  and  the  death  made  the  regional  population  not  to  cooperate  with 
IRA.  The  incident  eventually  caused  the  statement  of  ending  IRA  operations  by  a  leader  of  IRA, 
Gerry  Adams.  Surely,  there  are  differences  between  IRA  and  Middle  Eastern  terrorist  organiza- 
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tions.  However,  this  destabilization  of  IRA  shows  the  importance  of  manipulating  their  opera¬ 
tional  environment  in  contrast  to  the  less-than-expected  effectiveness  of  hard-liners’  search  and 
raid  tactics. 

2.2.  Existing  destabilization  analysis  approaches 


This  section  surveys  the  meaning  of  destabilization  and  the  existing  destabilization  analysis  ap¬ 
proaches.  In  the  beginning,  this  section  introduces  various  destabilization  definitions.  One  may 
regard  disrupting  task  performance  as  destabilization,  and  another  may  say  that  destabilization 
can  only  be  achieved  by  breaking  the  organization  into  pieces.  Next,  this  section  surveys  the 
analysis  approaches  that  can  satisfy  the  identified  requirements  of  the  previous  section.  Accord¬ 
ing  to  the  various  destabilization  levels,  analysts  have  used  different  approaches  and  computa¬ 
tional  tools  to  strategize  courses  of  actions  that  can  achieve  different  destabilization  effects.  The 
survey  includes  theories,  i.e.  dynamic  network  analysis,  decision  making  structure  analysis,  influ¬ 
ence  network  analysis,  and  multi-agent  simulation;  and  implementing  computer  tools,  i.e.  Orga¬ 
nizational  Risk  Analyzer,  Caesar  Hi,  Pythia,  and  JDynet. 

2.2.1.  The  definition  of  destabilization 

In  this  thesis,  destabilization  means  the  decrease  of  organizational  performance  over  the  course  of 
time  period.  This  definition  is  an  opposite  concept  of  stabilization  that  is  defined  by  Carley 
(1991).  However,  there  are  various  destabilization  effects,  which  vary  in  terms  of  significance, 
duration,  context,  etc.  This  section  also  explores  these  different  destabilization  effects  in  this  sec¬ 
tion. 


2.2.1. 1.  The  concept  of  destabilization 

The  concept  and  the  importance  of  network  destabilization  are  well  described  in  Networks  and 
Netwars  (Arquilla  and  Ronfledt,  200 1 ).  Arquilla  and  Ronfeldt  examined  many  different  networks 
ranging  from  social  activist  groups  to  violent  terrorist  groups.  They  found  five  major  aspects  of 
these  groups:  technological,  social,  narrative,  organizational  and  doctrinal.  Particularly,  the  dis¬ 
cussion  about  the  important  social  basis  for  cooperation  among  the  network  members  is  signifi¬ 
cant  in  this  context.  My  analysis  fundamentally  depends  on  the  importance  of  the  organizational 
structures,  and  the  social  basis  discussion  is  about  the  importance.  They  argue  that  a  network’s 
effectiveness  increases  when  it  has  built  mutual  trust  and  identity  based  on  strong  social  ties.  In 
other  words,  weakening  the  social  ties  is  the  start  to  undermine  the  terrorist  or  criminal  networks. 


To  clarify  the  concept  of  destabilization ,  understanding  what  Stabilization  is  important  because 
destabilization  is  an  inverse  impact  of  the  stabilization.  In  A  Theory  Of  Group  Stability  (Carley, 
1991),  Carley  identified  that  some  organizations  sustain  longer,  are  more  stable  and  are  better  at 
accepting  new  members  or  concepts  without  loosing  their  characteristics.  She  presents  an  idea, 
Constructuratism.  Compared  to  the  old  group  stability  theories,  which  asserts  that  favorable  con- 
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texts  are  necessary  to  stabilize  a  group  after  changes,  she  says  that  a  social  change  and  its  accom¬ 
panying  stabilization  come  from  changes  in  knowledge  distribution  as  the  organization’s  mem¬ 
bers  interact  and  diffuse  information.  Therefore,  we  can  hinder  the  stabilization  process  by  dis¬ 
rupting  the  interaction  and  diffusion.  As  the  context  of  this  work  emphasizes  the  covert  network 
nature  of  the  target  organization,  its  members  are  likely  to  interact  with  someone  who  is  a  neigh¬ 
bor  in  the  social  dimension.  Hence,  only  weakening  the  social  ties  may  not  be  most  efficient  in 
destabilization  process.  We  have  to  aim  the  critical  interaction  and  the  information  diffusion  paths 
and  cut  them  off. 

2.2. 1.2.  Levels  of  destabilization 

The  above  articles  about  destabilization  articulate  the  types  of  destabilization  that  they  expect. 
For  example,  Stabilization  in  Carley’s  article  means  a  seamless  integration  process  of  new  mem¬ 
bers  or  ideas,  and  I  flip  the  concept  to  define  destabilization  in  this  work.  However,  while  Car- 
ley’s  Stabilization  is  more  like  sociological  concept,  other  articles  define  destabilization  as  a  pure¬ 
ly  mathematical  or  graph  theoretic  concept  like  fragmenting  a  network  into  pieces  (Cohen  et  al, 
2000;  Borgatti,  2003).  Additionally,  some  operational  research  or  counterterrorism  experts  argue 
that  we  can  destabilize  a  network  by  preventing  their  work  performance  (Moon  and  Carley, 
2007d)  or  making  their  operational  environment  unfavorable  (Wagenhals  and  Levis,  2007).  Thus, 
we  need  to  define  the  concept  of  destabilization  before  we  start  building  a  strategy  to  induce  it. 


Breaking  the  organizational  Structure:  A  broken  network,  or  a  structure,  of  an  adversarial  organ¬ 
ization  may  be  the  evidence  of  destabilization  process.  There  are  theories  and  computation  tools 
to  support  breaking  a  network.  For  example,  NetAttack  is  a  network  analysis  and  disintegration 
simulation  tool  developed  by  Cohen  et  al  (Cohen  et  al,  2000).  The  tool  analyzes  the  network 
shape,  identify  key  personnel,  setup  node  removal  scenario  and  test  the  efficiency.  The  model  is 
not  a  stochastic  simulation  model,  whose  agents  try  to  restore  the  missing  links  and  isolated 
agents,  generally  known  as  network  healing.  Therefore,  the  model  is  meaningful  under  the  as¬ 
sumption  that  there  will  be  no  adaptation  and  evolution  of  the  analyzed  organization.  Furthermore, 
it  does  not  simulate  the  overall  complex  structure  of  an  organization.  For  example,  a  terrorist 
network  is  not  an  only  agent-to-agent  network,  represented  in  a  typical  social  network,  but  a 
complex  organizational  structure  where  knowledge  and  resource  are  exchanged,  tasks  are  as¬ 
signed  to  agents,  agents  are  connected  to  knowledge,  resource  and  perform  their  tasks  with  conti¬ 
nuous  evolution.  Additionally,  we  found  that  KeyPlayer  (Borgatti,  2003)  developed  by  Borgatti  is 
a  very  similar  tool  to  NetAttack,  but  the  same  limitations  can  also  be  applied  to  KeyPlayer.  Also, 
a  similar  concept  has  been  introduced  by  Farley  (2007).  Farley  presents  such  network  cut  prob¬ 
lems  in  mathematical  formulations,  rather  than  developing  a  tool  that  calculates  the  network  me¬ 
trics  by  comparing  before  and  after  the  cuts  of  networks. 

Removing  key  elements  to  decrease  the  organizational  performance:  Given  the  fact  that  the  ad¬ 
versarial  organization  is  able  to  heal  itself  and  adapt  to  a  changing  situation,  breaking  the  organi¬ 
zation  with  a  static  analysis  would  not  make  much  sense.  Instead  of  such  a  static  destabilization, 
we  can  aim  to  make  the  organization  stop  functioning.  For  instance,  if  the  adversarial  organiza- 
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tion  is  a  task-based  group,  the  organization  will  be  neutralized  by  preventing  the  task.  Thus,  some 
regarded  destabilization  as  inflicting  damage  on  the  task  performance.  For  instance,  Moon  and 
Carley  (Moon  and  Carley,  2007d)  defined  the  destabilization  of  a  network  as  the  state  of  network 
that  cannot  diffuse  knowledge  or  can  do  so  with  very  low  efficiency.  They  developed  a  destabili¬ 
zation  test-bed  simulation  providing  a  performance  measure,  knowledge  diffusion,  over  the 
course  of  a  simulation.  Thus,  their  evaluation  of  destabilization  sequence  depends  on  the  move¬ 
ment  of  the  knowledge  diffusion. 


Changing  operational  environment:  Rather  than  breaking  a  network  or  disrupting  communica¬ 
tion  channels,  we  can  change  the  operational  enviromnent  of  adversaries  (Wagenhals  and  Levis, 
2007;  Vego,  2006).  For  instance,  removing  a  set  of  terrorists  may  be  viewed  as  breaking  a  net¬ 
work  or  preventing  information  diffusion,  but  the  removals  also  induce  the  changes  in  the  per¬ 
sonnel  management  of  the  target  organization  and  put  it  in  a  difficult  operational  situation.  When 
we  expand  the  scope  of  intervention  from  an  intervention  on  network  to  an  intervention  on  the 
environment,  the  intervention  strategy  space  gets  diverse  and  rich.  We  identify  political,  military, 
economic,  social,  information  and  infrastructure  (or  PMES11)  dimensions  (DARPA,  2005)  that 
might  be  crucial  in  the  adversarial  operation,  and  we  intervene  the  dimensions  through  diplomatic, 
information,  military  and  economic  (or  DIME)  actions  (Elledge,  2003;  Thompson,  2005).  This 
intervention  idea  is  not  as  specific  as  the  above  direct  network  intervention  one.  This  is  at  the 
high  level  strategy  telling  what  friendly  forces  should  do  to  lower  the  chance  of  adversaries’  suc¬ 
cesses. 


2.2.2.  Existing  destabilization  analysis  approaches 

There  are  different  destabilization  analysis  approaches  concerning  different  levels  of  destabiliza¬ 
tion.  Literature  reviews  show  that  there  are  four  frequently  used  destabilization  approaches.  They 
analyze  the  target  from  different  perspectives  and  generate  different  courses  of  action  recommen¬ 
dations.  Particularly,  these  four  selected  approaches  can  address  the  previously  identified  destabi¬ 
lization  analysis  requirements.  Thus,  integrating  these  four  approaches  into  one  framework  is  my 
aim  throughout  this  paper.  This  section  introduces  what  the  selected  approaches  are  and  how  the 
approaches  are  used  in  the  past. 

2.2. 2.1.  Dynamic  network  analysis 

Social  network  analysis  has  been  used  to  represent  the  structure  of  an  adversarial  organization 
and  to  find  its  weakness.  After  9/11,  Krebs  (Krebs,  2002)  showed  the  terrorist  network  from  the 
social  network  analysis  perspective,  rather  than  using  a  tree-like  organizational  chart  (Farley, 
2003).  He  also  computed  basic  social  network  metrics,  such  as  degree,  betweenness  and  eigen¬ 
vector  centralities  (Freeman,  1979;  Bonacich,  1972),  to  show  who  critical  plan  executers  are. 
These  basic  social  network  analyses  are  possible  by  using  Pajek ,  UCtNet,  and  0 rganizationat 
Risk  Analyzer,  etc.  However,  his  analysis  remained  at  only  dealing  with  the  decentralized  organi¬ 
zational  formation.  The  analysis  ignored  the  complexity  and  adaptiveness  of  the  organization. 
Borgatti  (2003)  introduces  a  key -player  concept  and  a  computer  program,  Key  Player  and  UCi- 
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Net,  which  is  a  social  network  analysis  program  that  estimates  the  organizational  fragmentation 
level.  His  idea  is  removing  a  set  of  members  from  the  adversarial  group  and  dropping  the  organi¬ 
zation  integrity  measured  by  the  fragmentation  level.  This  is  a  typical  destabilization  analysis  of 
an  adversarial  group,  which  follows  assessing  the  organization,  identifying  the  target  member, 
and  measuring  the  result  after  the  removal  of  the  target.  Whereas  he  advanced  the  field  of  destabi¬ 
lization  analysis  using  social  networks,  his  network  is  still  only  about  the  members  of  the  group. 


On  the  other  hand,  Carley  (2006)  developed  an  extended  version  of  social  network  analysis,  or 
dynamic  network  analysis.  Dynamic  network  analysis  extends  the  scope  of  the  organizational 
structure  from  only  personnel  to  resources,  expertise,  tasks  as  well  as  people.  This  is  done  by  a 
meta-network  model  (Krackhardt  and  Carley,  1998).  We  adopt  this  organizational  structure  re¬ 
presentation.  Moreover,  she  invented  some  metrics  considering  such  diverse  node  types,  and  we 
use  the  metrics.  Furthermore,  she  incorporates  a  multi-agent  model,  which  is  a  trial  of  the  inte¬ 
grated  analysis  between  social  network  and  multi-agent  simulation.  This  trial  instigated  our  at¬ 
tempts  to  unify  other  approaches,  not  just  stopping  at  the  mixture  of  social  network  analysis  and 
multi-agent  simulation.  These  concepts  are  implemented  in  0 rganization  Risk  Analyzer  (Carley  et 
ah,  2007). 


2.2. 2.2.  Decision  making  structure  analysis 

Decision  making  structure  analysis  is  utilized  to  identify  the  critical  decision  making  structure  of 
the  adversaries  and  to  estimate  the  feasible  structures  under  their  operational  and  cultural  con¬ 
straints.  Originally,  this  analysis  is  heavily  used  in  the  command  and  control  (C2)  structure  analy¬ 
sis  (Alberts  and  Hayes,  2006).  This  C2  structure  analysis  is  about  designing,  understanding  and 
evaluating  the  decision  making  structures  of  military  units.  Thus,  the  C2  structure  analysts  ap¬ 
plied  the  concept  to  the  adversarial  organizations,  as  well. 


This  analysis  focuses  only  on  the  decision  making  part  of  an  organization.  In  other  words,  the 
analysis  does  not  concentrate  on  the  non-relevant  people  in  the  observed  group.  This  is  different 
from  social  network  analysis  that  often  analyzes  the  observed  networks  entirely  without  trimming. 
This  decision  making  structure  analysis  models  a  cognitive  process  of  an  individual  (Levis,  2005). 
Then,  the  analysis  defines  a  relationship  between  two  people  by  estimating  when  the  interaction 
happens  over  the  course  of  cognitive  and  decision  making  processes.  From  this  definition  of  deci¬ 
sion  making  relationships  (Kansal  et  al.,  2007),  the  analysis  is  able  to  classify  the  relevance  of  a 
person  in  the  course  of  decision  making.  Eventually,  this  enables  trimming  a  network  by  remov¬ 
ing  non-relevant  personnel. 


Furthermore,  this  analysis  produces  a  set  of  feasible  organizational  structures  under  cultural  and 
operational  constraints.  They  have  fixed,  none,  or  unknown  decision  making  relation-ships 
among  the  members  of  the  decision  making  structure.  Then,  a  computational  tool  permutes  the 
links  among  the  decision  makers  and  finds  organizational  structures  that  satisfy  the  relationship 


CMU  SCS  1SR 


-38- 


CASOS  Report 


specifications  and  the  user  defined  link  density.  These  decision  making  structure  analyses  are 
done  often  qualitatively  or  with  help  of  social  network  analysis.  Caesar  III  is  a  computer  program 
dedicated  to  perform  the  computational  analyses  of  decision  making  structure. 

2. 2. 2.3.  Influence  network  analysis 

Evaluating  complex  operational  environments  is  often  done  by  utilizing  an  influence  network 
model.  Influence  network  (Wagenhals  and  Levis,  2007;  Wagenhals  et  ah,  1998)  is  a  semi- 
Bayesian  network  including  belief  statement  nodes  and  causal  links  among  the  statement  nodes.  It 
has  parameters  enough  to  regenerate  a  conditional  probability  table  for  each  belief  statement  node, 
and  it  propagates  the  marginal  probabilities  of  the  nodes  from  the  bottom  nodes  to  the  root  node. 
It  has  mainly  used  in  anticipating  the  break-out  of  a  rare  event  when  we  do  not  have  enough  ob¬ 
servations  to  create  a  normal  Bayesian  network.  Therefore,  its  applications  are  not  commonly 
observable  events,  but  military  planning  and  counter-terrorism.  For  instance,  Wagenhals  and  Le¬ 
vis  (2007)  designed  an  influence  model  about  subduing  IED  attacks  in  Iraq.  Hudson  et  al.  (2001) 
introduces  potential  usages  on  counterterrorism,  and  Rosen  and  Smith  ( 1 996)  show  an  influence 
network  model  of  building  a  military  and  diplomatic  strategy.  There  are  a  couple  of  computer 
programs  supporting  this  analysis,  i.e.  SIAM  and  Pythia. 


Traditionally,  influence  network  has  been  produced  by  hands  of  subject  matter  experts.  They 
have  knowledge  of  the  target  situation  and  organization,  assess  belief  statements  related  to  a  tar¬ 
get  event  or  effect,  and  draw  an  influence  network  by  setting  up  its  nodes,  links  and  parameters 
based  on  their  own  knowledge.  However,  this  creates  a  number  of  problems  in  real  usages  of  this 
inference  tool  (Vego,  2006).  First,  the  generation  takes  a  long  time.  It  has  been  reported  that  a 
trained  intelligence  analyst  was  able  to  generate  a  network  that  correctly  estimated  what  would 
happen  in  the  next  phase  of  a  war  game,  but  he  could  not  deliver  the  model  on  time.  If  there  had 
been  an  automatic  support  tool  generating  an  influence  network  model,  he  must  have  used  it  to 
deliver  his  analysis  model.  Thus,  it  would  be  a  good  contribution  if  we  can  automatically  generate 
an  influence  network  from  an  organizational  structure  and  with  human  analysts’  opinion. 

2.2. 2.4.  Multi-agent  simulation 

Estimating  the  evolution  of  an  organizational  structure  is  from  multi-agent  simulations  (Moon 
and  Carley,  2007).  Particularly,  considering  that  the  adversarial  organization  is  hardly  observable 
constantly  and  almost  impossible  to  survey,  we  cannot  estimate  the  evolution  of  the  structure  in 
traditional  ways.  We  need  to  have  a  model  that  imitates  their  behavior  computationally. 


Among  the  simulation  models  for  vulnerability  analysis,  the  Virtual  Design  Team  (Kunz  et  al., 
1998)  project  aims  at  developing  computational  tools  to  analyze  and  simulate  decision  making 
and  communication  behavior  to  support  organizational  reengineering.  Also,  by  using  a  simulation, 
Lin  and  Carley  (1997)  identify  strong  factors  of  an  organization's  performance  and  weakness.  In 
their  paper,  they  simulated  an  organization's  performance  based  on  a  model  of  agents’  informa¬ 
tion  processing  and  an  organization’s  resource  dependency.  Finally,  Moon  and  Carley  (2007)  es- 
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timates  the  social  and  geospatial  distribution  change  over-time  with  a  simulation  model.  They  use 
a  global  terrorist  network  to  build  up  a  virtual  reality  for  agent  interactions  and  relocations.  The 
model  produces  the  expected  future  terrorists’  geospatial  distributions  and  social  criticalities. 

2. 2. 2.5.  Problems  in  using  these  approaches 

Analysts  tend  to  specialize  in  specific  tools,  and  each  specific  tool  captures  only  part  of  the  analy¬ 
sis  problem.  These  partial  analyses  of  targets  result  in  very  different  policy  recommendations  or 
vulnerability  assessments.  For  instance,  one  analyst  only  using  the  static  social  network  analysis 
approach  will  identify  some  terrorists  as  the  critical  personnel  in  a  terrorist  network.  However, 
another  analyst  only  using  the  influence  networks  will  select  some  political,  military,  social,  eco¬ 
nomic,  information  or  infrastructure  (PMESII)  areas  (Snyder  and  Tolk,  2006)  that  friendly  forces 
can  work  on  to  make  the  targets’  operational  environments  unfavorable.  The  two  analyses  focus 
on  how  to  damage  the  targets’  performances,  but  they  have  very  different  and  incompatible  im¬ 
plications  and  results. 


Each  of  these  techniques  has  a  key  strength  and  suffers  a  key  limitation;  consequently,  while  val¬ 
uable,  the  results  might  be  biased,  not  robust  against  the  complexity  and  the  size  of  the  targets,  or 
may  require  a  massive  amount  of  subject  matter  experts’  time.  Also,  it  should  be  noted  that  there 
tend  to  be  large  databases  with  relational  information  on  who  interacted  with  who,  was  seen 
where,  took  part  in  what  activity,  etc.  Thus,  there  is  data  for  these  tools.  Dynamic  social  network 
techniques  make  use  of  most  of  the  empirical  data;  but  have  no  way  of  drilling  down  and  focus¬ 
ing  on  just  those  actors  critical  relative  to  a  particular  problem.  Techniques  to  assess  the  decision 
making  structure,  require  human  analysts  to  come  up  with  a  decision  making  structure  from  their 
subject  knowledge  or  qualitative  reports  (Kansal  et  al.  2007;  Levis,  2005).  Drilling  down  to  just 
what  is  relevant  to  the  problem  being  assessed  is  problematic.  The  structures  are  often  built  on  a 
small  sample  of  the  data  used  by  the  dynamic  social  network  techniques;  but  the  focus  is  exclu¬ 
sively  on  the  problem  being  assessed.  Similarly,  an  influence  network  model  built  by  human  ana¬ 
lysts  is  subject  to  the  analysts’  prejudice  (Vego,  2006);  but,  it  allows  the  analyst  to  assess  proba¬ 
bilistic  changes  in  the  likelihood  of  events  under  diverse  scenarios.  Both  decision  making  struc¬ 
tures  and  influence  networks  require  the  analyst  to  spend  a  large  amount  of  time,  weeks  or  even 
months  is  not  uncommon,  and  resources  to  generate  a  single  model.  Consequently,  these  tech¬ 
niques  are  under-utilized  and  their  use  saved  for  critical  situations  where  there  is  a  long  lead  time 
for  analysis.  If  the  input  to  these  techniques  could  be  derived  from  the  data  used  by  dynamic  so¬ 
cial  network  programs,  in  an  automated  or  semi-automated  fashion  more  models  could  be  pro¬ 
duced  in  less  time,  with  less  bias,  thus  enabling  the  decision  making  and  influence  network  tools 
to  be  more  widely  used.  In  other  words,  a  key  point  of  integration  is  to  use  dynamic  social  net¬ 
work  techniques  to  generate  decision  structures  and  influence  net-works.  The  decision  making 
and  influence  networks  could  in  turn  be  used  to  provide  focus  to  the  network  data  and  enable  the 
analyst  a  systematic  approach  to  drilling  down  and  focusing  on  the  part  of  the  network  that  is 
most  relevant.  Courses  of  action  can  be  assessed  by  reading  them  as  inputs  to  a  multi-agent  simu¬ 
lation  model  designed  to  evolve  the  adversarial  organization  through  time.  Currently  to  generate 
the  simulation  inputs,  human  analysts  have  to  spend  a  long  time  to  code  a  lengthy  parameter  set¬ 
ting  script  (Carley  et  al.  2007).  A  wide  range  of  virtual  experiments  need  to  be  done  to  understand 
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the  entire  response  of  the  simulation  model.  However,  since  each  of  the  network,  decision  mak¬ 
ing  and  influence  network  techniques  enable  the  analyst  to  identify  courses  of  action  that  are  like¬ 
ly  to  influence  the  adversarial  organization  in  negative  ways,  if  we  could  use  their  outputs  as  in¬ 
puts  to  the  simulation  the  time  to  generate  the  over  time  assessments  would  be  reduced.  A  sec¬ 
ondary  and  technical  advantage  to  integration  is  that  it  enables  the  analyst  to  not  worry  about  data 
formats. 


2.3.  Summary  of  Identified  Requirements  and  Selected  Destabilization  Ap¬ 
proaches  to  Satisfy  the  Requirements 


1  listed  four  attributes  of  adversarial  organizations.  These  four  attributes  derive  requirements  for 
the  integrated  destabilization  analysis.  Also,  1  listed  four  destabilization  analysis  approaches. 
These  four  analysis  approaches  have  been  used  in  the  field  separately.  One  analysis  approach 
cannot  cover  a  single  derived  requirement  alone.  To  address  a  single  requirement,  1  need  to  use 
multiple  approaches  in  the  integrated  manner.  I  summarize  the  derived  requirements  and  appro¬ 
priate  computational  tools  to  address  the  requirements  below.  Additionally,  these  requirements 


and  corresponding  tools  are  displayed  in  Table  2-2 


1)  The  analysis  of  decentralized  organizational  structures  should  be  possible. 

This  is  possible  by  applying  dynamic  network  analysis  to  a  network  structure,  a  meta¬ 
network. 


2)  The  integrated  framework  should  infer  hidden  critical  contacts  and  communication 
links  to  determine  implied  decision  making  structures. 

We  apply  the  decision  making  interaction  models  to  infer  the  decision  making  structures. 
The  models  include  information  sharing,  result  sharing,  and  command  interpretation.  Al¬ 
so,  the  data  for  the  inference  should  be  from  the  network  representation,  a  meta-network. 

3)  The  framework  needs  to  assess  the  complex  operational  environments  and  to  esti¬ 
mate  the  task  success  of  the  targets. 

This  is  achieved  by  integrating  a  prediction  model,  or  an  influence  network,  and  a  repre¬ 
sentation  model,  or  a  meta-network. 

4)  The  framework  should  estimate  the  future  changes  of  the  target  organizations. 

The  integrated  framework  applies  a  multi-agent  simulation  model,  JDynet,  to  the  net¬ 
worked  organizational  structure,  a  meta-network. 
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Table  2-2  Summary  of  adversarial  organizations’  critical  aspects,  identified  destabilization  require¬ 
ments,  and  computation  approaches  to  address  the  requirements 


Adversarial  organiza¬ 
tions’  critical  aspect  re- 
quiring  computational 
analyses 

Identified  requirements 

Partial  theoretical 
solutions 

Partial  analy¬ 
sis  tools 

The  adversarial  organiza¬ 
tions  are  decentralized  and 
loosely  coupled 

The  analysis  of  decentra¬ 
lized  organizational  struc¬ 
tures  should  be  possible. 

Dynamic  network 
analysis 

ORA,  Key 

Player,  UCI- 
Net,  Pajek,  Dy- 
netML 

The  adversarial  organiza¬ 

The  integrated  framework 

tions  are  often  hidden  in 

should  infer  hidden  criti¬ 

Decision  making 

communities,  and  the  or¬ 

cal  contacts  and  commu¬ 

structure  analysis, 

Caesar  III 

ganizations  hide  their  sig¬ 

nication  links  to  deter¬ 

Dynamic  network 

ORA 

nificant  decision  making 

mine  implied  decision 

analysis 

structures 

making  structures. 

The  framework  needs  to 

The  adversarial  organiza¬ 

assess  the  complex  opera¬ 

Influence  network 

Pythia,  SIAM, 
ORA 

tions  perform  complex 

tional  environments  and 

analysis,  Dynamic 

tasks 

to  estimate  the  task  suc¬ 
cess  of  the  targets. 

network  analysis 

The  adversarial  organiza¬ 
tions  are  adaptive 

The  framework  should 

estimate  the  future 
changes  of  the  target  or¬ 
ganizations. 

Multi-agent  simula¬ 
tion,  Dynamic  net¬ 
work  analysis 

JDynet,  Con¬ 
struct 
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3.  Integrated  Destabilization  Analysis  Framework 


This  chapter  describes  an  integrated  destabilization  analysis  framework1  that  satisfies  the  identi¬ 
fied  requirements  in  the  previous  chapter.  Particularly,  from  many  literature  review  findings,  four 
destabilization  analysis  requirements  emerged  as  primary  requirements  of  the  integrated  frame¬ 
work. 

1 )  The  analysis  of  decentralized  organizational  structures  should  be  possible. 

2)  The  integrated  framework  should  infer  hidden  critical  contacts  and  communication  links 
to  determine  implied  decision  making  structures. 

3)  The  framework  needs  to  assess  the  complex  operational  environments  and  to  estimate  the 
task  success  of  the  targets. 

4)  The  framework  should  estimate  the  future  changes  of  the  target  organizations. 


These  requirements  cannot  be  satisfied  with  a  single  existing  destabilization  analysis  approach 
surveyed  in  the  previous  section.  Thus,  the  integrated  framework  needs  to  make  the  approaches 
interoperable,  so  that  human  analysts  can  use  multiple  approaches  sequentially  to  address  the 
above  requirements.  This  interoperation  should  be  done  at  two  levels.  The  theories  behind  the 
approaches  should  be  linked,  and  the  tools  implementing  the  approaches  should  be  connected. 


These  relations  are  summarized  id  Table  3-1 


Table  3-1  Summary  of  identified  requirements,  related  existing  approaches  and  computational  arti¬ 
facts  supporting  the  approaches 


Requirement 

Related  approaches 

Supporting  computa¬ 
tional  programs  or 
formats 

The  analysis  of  decentralized  organizational 
structures  should  be  possible. 

Dynamic  network  anal¬ 
ysis 

ORA,  DynetML 

The  integrated  framework  should  infer  hid¬ 
den  critical  contacts  and  communication 
links  to  determine  implied  decision  making 
structures. 

Dynamic  network  anal¬ 
ysis,  Decision  making 
structure  analysis 

ORA,  Caesar  III,  Dy¬ 
netML 

The  framework  needs  to  assess  the  complex 
operational  environments  and  to  estimate 
the  task  success  of  the  targets. 

Dynamic  network  anal¬ 
ysis,  Influence  network 
analysis 

ORA,  Pythia,  Dy¬ 
netML 

1  The  framework  in  this  thesis  refers  to  the  unified  software  system  and  the  procedure  of  using  the  system. 
The  unified  software  system  includes  ORA  and  ORA’s  functions  to  interface  the  other  software  tools,  such 
as  Caesar  III,  Pythia  and  Dynet.  The  analysis  procedure  of  the  unified  system  is  described  more  in  Ch.  9. 
Ch  3.1.  is  the  description  of  the  integrated  software  system. 
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The  framework  should  estimate  the  future 
changes  of  the  target  organizations. 


Dynamic  network  anal¬ 
ysis,  Multi-agent  simu¬ 
lation 


ORA,  JDynet,  Dy- 
netML 


Table  3-1  suggests  three  key  framework  development  directions.  Firstly,  the  adversarial  organiza¬ 
tion  is  regarded  as  a  multi-mode,  multi-plex  social  network,  or  a  decentralized  complex  adaptive 
system.  Previously,  I  pointed  out  that  the  meta-network  model  can  represent  such  organizations. 
Secondly,  the  destabilization  effect  is  estimated  by  using  four  different  analysis  approaches:  dy¬ 
namic  network  analysis,  decision  making  structure  analysis,  influence  network  analysis,  and  mul¬ 
ti-agent  models.  According  to  my  survey,  there  are  existing  computational  tools  supporting  these 
different  approaches.  If  1  make  these  computational  tools  interoperable,  then  the  framework  of 
destabilization  analysis  is  completed.  Thirdly,  the  framework  provides  a  set  of  assessments  about 
the  target  organization  and  recommends  a  set  of  courses  of  action  (COA)  that  destabilizes  the  tar¬ 
get  organization. 

1 )  The  framework  should  take  a  network  representation  of  an  adversarial  organization. 

2)  The  framework  is  completed  if  the  above  supporting  computational  artifacts  become  inte¬ 
roperable  through  data  format  exchange  or  integrated  into  a  single  component. 

3)  The  framework  should  generate  an  output  about  the  assessments  and  destabilization  of 
the  target  organization. 

This  chapter  describes  the  unified  framework  in  overall.  This  chapter  shows  1)  what  the  input  is, 
2)  what  the  output  is,  and  3)  what  the  integrated  system  looks  like.  The  detailed  integration  be¬ 
tween  a  pair  of  approaches  is  explained  in  the  next  three  chapters,  not  in  this  chapter. 

3.1.  Overview  of  the  integrated  analysis  system 

This  system  includes  various  existing  tools  and  data  formats.  While  a  fundamental  idea  is  utiliz¬ 
ing  the  various  analysis  approaches  to  build  the  destabilization  analysis  results  from  multiple 
perspectives,  the  approaches  are  implemented  in  different  programs,  and  they  require  different 
input  datasets.  1  explain  how  to  integrate  and  interoperate  these  different  programs  by  transform¬ 
ing  the  programs’  input  and  output  from  one  to  another.  Figure  3-1  is  an  outline  of  the  integrated 
destabilization  analysis  system.  The  figure  shows  how  the  tools  are  linked,  what  inputs  are  re¬ 
quired,  and  what  outputs  are  expected. 
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Dynet-Spatial:  Geo-space  Multi-agent  Simulation 
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Destabilization 
Effect  Estimation 


Human 
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Figure  3-1  the  high  level  abstract  of  the  integrated  analysis  system 

3.2.  A  type  of  input  dataset  -  Meta-network  of  an  adversarial  organization 


As  show  in 


Figure  3-1  (find  Target  Network  in  the  figure),  an  input  to  this  unified  system  is  a 


network  representation  of  the  organizational  structure.  This  organizational  structure  is  in  the  so¬ 
cial  dimension  as  well  as  the  geospatial  dimension.  Additionally,  information  on  knowledge, 
tasks  and  who  knows  and  is  doing  what  are  used.  Therefore,  the  input  is  a  large  network  across  a 
set  of  different  nodes:  agents,  knowledge,  tasks,  locations,  etc.  For  instance,  if  there  have  been 
interactions  or  formal  relations  between  two  agents,  we  assume  that  there  is  a  link  between  the 
two.  Similarly,  if  an  agent  possesses  a  knowledge  piece,  then  we  link  the  agent  node  to  the  know¬ 
ledge  node.  If  two  locations  appear  in  the  same  context,  we  regard  the  two  locations  are  related. 
This  topological  location  networks  will  be  the  agent  relocation  dimension.  The  other  sub¬ 
networks  have  their  own  intuitive  interpretations  based  on  the  connected  node  types.  We  use  this 
multi-mode  and  multi-link  network  data  as  our  input  to  the  model  with  the  assumption  that  it 
represents  the  current  structural  characteristics  of  the  organization.  Particularly,  the  adjacency 
matrix  of  the  network  is  called  as  a  meta-network.  DynetML  is  an  XML  type  for  a  meta-network. 
It  saves  the  meta-network  information  inclusively  and  is  loadable  in  ORA. 
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3.3.  A  type  of  output  result  -  Assessment  on  adversarial  organization  and  its 
destabilization  effect  estimation 

An  output,  An  assessment  on  adversarial  organization  and  Its  destabilization  effect  estimation  in 


Figure  3-1]  from  this  system  is  a  set  of  assessment  results  and  destabilization  estimation  regarding 


the  target  organization.  The  assessment  results  include  1 )  key  personnel  in  decision  making  struc¬ 
tures,  2)  key  personnel  profiles  considering  the  decision  making,  3)  key  task  completion  likelih¬ 
oods,  4)  key  task  completion  likelihoods  sensitivity  analysis  from  different  levels  of  task  difficul¬ 
ties  and  organization  supports,  etc.  The  destabilization  effect  estimation  includes  1)  the  over-time 
organizational  performance  changes,  2)  the  impact  toward  the  task  and  the  mission  completion 
speeds,  3)  the  task  and  mission  completion  timings,  and  4)  the  social  and  geospatial  organization¬ 
al  changes  over-time. 

3.4.  Interoperability  among  analysis  approaches 


The  boxes,  such  as  Decision  making  Structure  Extractor,  Influence  Network  Generator ,  etc  inside 
of  ORA  in  Figure  3-1.  are  the  functions  enabling  interoperations.  The  key  of  this  integration 


among  analysis  approaches  is  interoperability  among  analysis  tools.  I  will  use  Organization  Risk 
Analyzer  {ORA)  (Reminga  and  Carley,  2004)  as  a  main  analysis  package,  which  means  that  the 
analysis  procedure  starts  by  loading  the  information  of  an  adversarial  organization  on  ORA. 
However,  ORA  is  a  dynamic  network  analysis  package  that  lacks  simulation  analysis,  influence 
network  analysis  and  decision  making  structure  analysis  capabilities.  Therefore,  I  implement  the 
interoperability  functions  in  ORA  to  utilize  the  existing  package  doing  the  above  analyses.  I 
coded  ORA’s  Near-Term  Analysis  to  integrate  a  simulation  model,  JDynet,  similarly,  ORA’s  In¬ 
fluence  Network  Generator  for  Pythia,  an  influence  network  analyzer;  and  ORA’s  Command  and 
Control  Structure  extractor  for  Caesar  III,  a  decision  making  structure  analyzer. 


3.5.  Dataset  transformation  to  support  the  interoperations 


The  interoperation  among  the  above  approaches  is  accomplished  by  enabling  ORA  generate  the 
datasets  for  the  approaches  and  import  the  outputs  from  them.  Since  there  are  four  different  ana¬ 
lyses,  ORA  can  produce  four  different  datasets.  However,  since  the  two  simulation  analyses  will 
take  the  same  inputs,  only  three  datasets,  a  dataset  for  CAESAR  III,  Pythia  and  JDynet ,  will  be 
required.  This  dataset  transformation  is  from  a  meta-network  to  the  three  data  fonnats.  However, 
this  is  not  a  simple  XML  level  conversion  though  technically  it  is  a  transformation  from  Dy- 
netML,  or  a  meta-network  XML  data  structure,  to  a  XML  file,  i.e.  CAE,  or  an  input  for  CAESAR 
III.  This  is  not  simple  because  the  meta-network  and  the  other  datasets  are  not  in  the  relation  of 
one-to-one  match.  We  need  to  infer  a  decision  making  structure,  an  influence  network  or  a  setting 
for  simulations  from  a  meta-network.  Thus,  the  actual  work  to  complete  required  interoperability 
and  this  unified  analysis  system  is  establishing  functions  transforming  the  datasets  and  integrating 
these  transformation  functions  into  ORA.  Also,  the  inference  for  the  transformation  is  the  devel¬ 
oped  theory  to  enable  this  unification. 
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3.6.  Enabled  destabilization  analysis  by  interoperations 


This  integrated  system  enables  existing  analyses  as  well  as  many  new  analyses  that  cannot  be 
done  by  the  separate  usage  of  the  existing  tools.  Each  of  these  analyses  addresses  a  part  of  desta¬ 
bilization  analysis  requirements  above.  Table  3-2  lists  these  analyses,  the  addressed  destabiliza¬ 


tion  analysis  requirements,  and  the  required  interoperation  between  approaches  and  between  tools. 


Table  3-2  Summary  of  enabled  destabilization  analysis  by  interoperations 


Enabled  anal¬ 
ysis 

Addressed  requirements 

Required  interopera¬ 
tion  between  ap¬ 
proaches 

Implemented 
interoperation 
between  tools 

Dynamic  net¬ 
work  analysis 

Analysis  of  decentralized  orga¬ 
nizational  structures 

Dynamic  network 
analysis 

ORA 

Decision  mak¬ 
ing  structure 
analysis 

Analysis  of  decentralized  orga¬ 
nizational  structures 

Decision  making  struc¬ 
ture  analysis 

Caesar  III 

Influence  net¬ 
work  analysis 

Assessment  on  the  complex  op¬ 
erational  environments 

Influence  network 
analysis 

Pythia 

Multi-agent 

simulation 

Estimation  on  the  future  changes 
of  the  target  organizations. 

Multi-agent  simulation 

JDynet 

Decision  mak¬ 
ing  structure 
extraction  from 

networks 

Analysis  of  decentralized  orga¬ 
nizational  structures,  Inference 
on  hidden  critical  contacts  and 

communication  links 

Dynamic  network 
analysis,  Decision 
making  structure  anal¬ 
ysis 

ORA,  Caesar  III 

Influence  net¬ 
work  genera¬ 
tion  from  net¬ 
works 

Assessment  on  the  complex  op¬ 
erational  environments 

Dynamic  network 
analysis,  Influence 
network  analysis 

ORA,  Pythia 

Multi-agent 

simulation 

about  the  evo¬ 
lution  of  net¬ 
works 

Analysis  of  decentralized  orga¬ 
nizational  structures 

Dynamic  network 
analysis,  Multi-agent 
simulation 

ORA,  JDynet 

Evolution  of 

core  decision 
making  struc¬ 
ture 

Analysis  of  decentralized  orga¬ 
nizational  structures,  Inference 
on  hidden  critical  contacts  and 

communication  links.  Estimation 
on  the  future  changes  of  the  tar- 

Dynamic  network 
analysis,  Decision 
making  structure  anal¬ 
ysis,  Multi-agent  simu¬ 
lation 

ORA,  Caesar  III, 
JDynet 
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Enabled  anal¬ 
ysis 

Addressed  requirements 

Required  interopera¬ 
tion  between  ap¬ 
proaches 

Implemented 
interoperation 
between  tools 

get  organizations. 

Evolution  of 
operational  en¬ 
vironment 

Assessment  on  the  complex  op¬ 
erational  environments,  Estima¬ 
tion  on  the  future  changes  of  the 
target  organizations. 

Dynamic  network 
analysis,  Influence 
network  analysis,  Mul¬ 
ti-agent  simulation 

ORA,  Pythia, 
JDynet 

Evaluation  of 
hidden  opera¬ 
tional  environ¬ 
ment 

Analysis  of  decentralized  orga¬ 
nizational  structures,  Inference 
on  hidden  critical  contacts  and 
communication  links,  Assess¬ 
ment  on  the  complex  operational 
environments,  Estimation  on  the 
future  changes  of  the  target  or¬ 
ganizations. 

Dynamic  network 
analysis,  Decision 
making  structure  anal¬ 
ysis,  Influence  network 
analysis,  Multi-agent 
simulation 

ORA,  Caesar  III, 
Pythia,  JDynet 

3.7.  Potential  challenges  in  the  integration 


This  integrative  approach  opens  important  research  questions  as  well  as  technical  questions.  1  list 
some  of  such  questions  below.  These  may  not  be  addressed  in  this  thesis  fully,  but  some  ques¬ 
tions  are  negotiated  by  adjusting  levels  of  integration  or  limiting  the  scale  of  the  target  organiza¬ 
tions. 

Overlapping  Analysis  Assumptions  and  Parameters:  if  two  models  are  integrated,  care  must 
be  taken  that  the  basic  assumptions  of  each  model  are  met  and  that  the  theoretical  foundations  are 
not  undermined.  Another  critical  factor  is  to  make  sure  that  the  interpretation  of  similar  parame¬ 
ters  is  consistent.  While  these  points  are  obvious,  in  practice  these  goals,  if  they  are  to  be  met, 
may  require  substantial  theoretical  and  methodological  advances. 


Scope  Of  Analysis  Time-span:  This  unified  system  integrates  four  different  tools  dealing  with  a 
different  scope  of  time.  For  instance,  users  of  Construct  usually  assumed  that  one  time-step  cor¬ 
responds  to  one  week  in  the  real  world.  The  message  passing  time  intervals  among  decision  mak¬ 
ers  in  Caesar  III  must  be  much  faster  than  a  week.  Also,  influence  networks  regarding  a  long 
term  strategy  will  have  a  longer  time  span  than  any  other  tools.  This  different  time  scope  issue 
gets  worse  because  1  am  treating  an  adversarial  organization  as  an  adaptable  system.  Adaptation 
means  that  it  changes  over-time,  and  the  time  interval  between  changes  should  be  negotiated 
among  these  tools.  One  ideal  solution  would  be  setting  up  a  standard  time  interval  among  these 
models.  For  example,  one  time-step  in  Construct  is  one  week  in  real  world,  and  it  should  corres- 
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pond  to  one  time-step  in  timed  influence  network.  However,  this  standardized  time-step  idea 
should  be  investigated  furthermore  to  see  the  feasibility  of  implementing  it  among  the  models. 


Different  Scalability:  This  analysis  procedure  and  system  is  limited  to  an  analysis  of  a  medium 
size  organization,  i.e.  a  group  with  about  hundreds  of  members.  This  limitation  of  scalability  is 
from  computational  difficulties  of  analyses.  It  will  take  considerable  amount  of  time  if  we  run  a 
simulation  analysis  with  over  thousands  of  agents  since  the  potential  social  interactions  grows  as 
the  number  of  agents  to  analyze  increases.  Furthermore,  the  evaluation  logic  inside  Pythia,  or 
CAST  algorithm,  has  a  component  whose  big-0  notation  grows  exponentially.  However,  this  li¬ 
mitation  of  analysis  scalability  may  be  overcome  by  exploiting  the  suggested  unified  approaches. 
In  facts,  an  analysis  that  should  cover  over  thousands  of  people  is  rare.  Often,  the  scalability 
problem  emerges  when  analysts  have  no  idea  to  limit  the  scope  of  the  investigation.  In  such  a 
sense,  we  can  use  the  interoperation  between  network  and  decision  making  structure  analyses, 
limit  the  organizational  structures  to  a  particular  core  group  of  interest,  and  run  analyses  only  on 
an  identified  core  group.  This  utilization  of  this  system  will  ease  the  difficulties  coming  from  sca¬ 
lability  of  analysis  modules. 


Maintenance  Problem:  This  integrated  system  significantly  sophisticates  the  overall  analysis 
procedures.  Eventually,  any  changes  of  an  involved  component  will  cause  changes  of  other  com¬ 
ponents.  This  creates  a  maintenance  problem  that  different  software  development  groups  are  in¬ 
volved.  Therefore,  I  need  to  adjust  the  level  of  integrations,  so  that  the  changes  of  one  model  can 
be  contained,  and  not  necessarily  influence  the  other  components.  This  is  also  critical  from  the 
perspective  of  software  errors.  I  mitigate  this  maintenance  problem  by  accomplishing  the  intero¬ 
peration  through  data  transformations.  By  not  coupling  the  software  components  at  the  source 
code  or  program  package  level,  I  can  avoid  source  code  ownership  problem  or  any  serious  in¬ 
volvements  of  developers  of  Caesar  III,  Pythia  and  JDynet. 
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4.  Dataset  for  Empirical  Analysis 


I  use  three  datasets  to  illustrate  the  analysis  procedure  of  the  integrated  framework.  The  three  da¬ 
tasets  are  1)  an  organizational  structure  of  terrorist  group  responsible  for  the  1998  U.S.  embassy 
bombing  incidents  in  Tanzania  and  Kenya,  2)  an  organizational  structure  for  the  1998  U.S.  em¬ 
bassy  bombing  incident  in  Kenya,  and  3)  an  aggregated  organizational  structure  for  the  current 
global  terrorist  network.  These  datasets  are  chosen  because  1)  they  have  been  cleaned  by  a  human 
analysts  based  on  an  open-source  information;  2)  they  have  required  organizational  structures, 
such  as  task  dependency  network,  for  the  integrated  approach;  3)  their  sizes  ranging  from  a  small 
task-force  team  to  a  global  level  organization  big  enough  to  demonstrate  the  scalability  of  this 
integrated  approach;  and  4)  they  are  in  the  same  format  of  other  terrorist  organizational  structures 
produced  by  Center  for  Computational  Analysis  of  Social  and  Organizational  Systems  (CASOS). 


Some  of  datasets  owned  by  CASOS  are  not  used  because  of  the  following  reasons. 

•  Dataset  without  any  task  dependency  network  component:  All  of  the  analysis  com¬ 
ponents  in  this  framework  extensively  uses  a  task  dependency  network  of  an  organization. 
Therefore,  this  is  an  important  feature  that  we  cannot  run  this  analysis  framework  without. 

•  Dataset  without  any  location  information:  The  location  information  includes  the  lati¬ 
tude  and  longitude  of  location  nodes;  agent,  resource,  expertise,  task  distributions  across 
the  locations;  and  location-to-location  movement  network.  Even  though  this  information 
is  not  included  in  the  dataset,  still  we  can  run  the  analysis  until  Ch.  8.  However,  1  ex¬ 
cluded  the  datasets  without  any  location  information,  so  that  every  dataset  I  test  in  this 
work  can  go  through  the  whole  analysis  framework. 

•  Dataset  with  more  than  hundreds  of  agents:  The  newly  developed  JDynet  logic  uses 
more  sophisticated  operations  research  oriented  agent  behavior  logic  compared  to  its  pre¬ 
decessor  model,  Construct.  Furthermore,  using  such  operations  research  oriented  simula¬ 
tion  model  for  simulating  more  than  hundreds  of  agents  might  be  inappropriate  because 
1 )  the  simulated  organization  may  be  actually  multiple  organizations  with  different  mis¬ 
sions,  2)  longer  time  span  and  larger  population  can  be  explained  better  with  sociological 
model,  rather  than  a  task-performance  oriented  model.  Therefore,  I  excluded  such  data¬ 
sets. 

•  Dataset  without  any  clear  resource/expertise  requirement  to  perform  task  and  agent 
assignment  to  task:  I  excluded  such  datasets  because  of  the  same  reason  why  1  excluded 
the  dataset  without  any  task  dependency  network.  Resources  and  expertise  requirement 
and  agent  assignment  of  tasks  are  important  in  inferring  the  decision  making  structure, 
generating  an  influence  network,  and  simulating  the  mission  performance  of  agents. 

4.1.  Meta- Network  for  Representing  an  0  rganizational  Structure 


A  meta-network  (Krackhardt  and  Carley,  1998;  Carley,  2006a)  is  a  multi-mode,  multi-relation 
network  that  this  paper  utilizes  to  represent  an  organizational  structure.  We  might  describe  it  us¬ 
ing  a  matrix  of  relations  as  in  Table  4-1  From  an  organizational  task  perspective,  there  are  four 
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basic  types  of  nodes  of  interest:  people,  expertise,  resources,  and  tasks,  and  other  extensive  types 
of  nodes,  i.e.  location,  belief,  event,  organization,  etc,  can  be  included.  The  relations  among  these 
who  interacted  with  whom,  who  has  access  to  what  resources,  what  has  what  knowledge  or  ex¬ 
pertise,  who  can  or  has  done  what  task,  what  resources  are  needed  for  what  task,  and  what  know¬ 
ledge  is  needed  for  what  task  or  to  use  what  resource.  Each  of  these  can  be  observed,  with  some 
level  of  uncertainty,  and  for  many  groups  only  in  an  “after  the  fact”  fashion,  hip 
sake  of  illustration,  we  define  a  possible  network  for  each  of  the  cells. 


Table  4-1 


for  the 


Table  4-1  Meta-Network  component  Networks 


People 

Expertise 

Location 

Resources 

Tasks 

People 

Social  Net¬ 
work 

Expertise 

Network 

Personnel 

Distribution 

Network 

Resource 

Network 

Assignment 

Network 

Expertise 

Information 

Network 

Regional  In¬ 
fonnation 

Network 

Skills  Net¬ 
work 

Expertise 
Needs  Net¬ 
work 

Location 

Transnational 

Passage 

Network 

Regional  Re¬ 
source  Net¬ 
work 

Regional  Task 
Network 

Resources 

Substitution 

Network 

Resource 

Needs  Net¬ 
work 

Tasks 

Task  Prece¬ 
dence  Net¬ 
work 

Meta-network  is  not  just  limited  to  a  social  network,  which  is  only  one  part  of  meta-network.  Me¬ 
ta-network  covers  much  broader  concepts  related  to  an  organizational  structure.  These  concepts 
are  task  assignment,  resource  distribution,  infonnation  diffusion,  resource  requirements  for  tasks, 
and  so  on.  Since  this  is  not  just  social  relationship  infonnation,  analysts  can  store  any  of  their 
knowledge  regarding  how  the  adversarial  organizations  structured  for,  prepared  for  and  executed 
the  tasks.  For  instance,  Task  Precedence  Network  ini 


Table  4-1 


is  more  commonly  analyzed  by 
analysts  in  the  operations  research  field.  Information  Network  in  Table  4-1  is  a  frequent  topic  for 
the  infonnation  scientists  researching  knowledge  management  system  or  knowledge  map.  How¬ 
ever,  all  of  these  concepts  are  critical  factors  in  understanding  how  an  organization  operates,  and 
these  concepts  can  be  systematically  stored  in  Meta-Network.  This  additional  information  of  the 
organizations  enable  each  component  of  this  integrated  analysis  framework. 


Technically,  a  meta-network  is  stored  as  one  DynetML  file,  a  technical  input  to  Organization 
Risk  Analyzer.  A  DynetML  file  is  an  XML  file  designed  to  store  a  meta-network  flexibly.  This 
file  type  is  much  more  flexible  than  the  other  structures,  such  as  DL  file  fonnat  or  UCINet  file 
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format.  A  DynetML  file  can  store  a  multi-modal  and  muli-plex  network,  but  a  DL  file  can  only 
store  a  flat  network  like  a  social  network  showing  only  one  type  of  relations.  Analysts  can  read  a 
DynetML  file  even  with  text  editors  or  XML  editors,  but  a  UCINet  file  is  only  interoperable  with 
UCINet.  The  detailed  format  of  a  DynetML  file  can  be  found  in  Tsvetovat  et  al.  (2003). 

4.2.  1998  US  Embassy  Bombings  in  Kenya  and  Tanzania 

1998  US  Embassy  Bombings  in  Kenya  and  Tanzania  is  a  series  of  incidents  executed  by  al-Qaeda. 
In  Kenya,  a  bomb  in  a  vehicle  adjacent  to  the  embassy  building  was  detonated  and  resulted  in  212 
casualties  and  about  4000  woundeds,  and  in  Tanzania,  a  vehicle  bomb  was  also  detonated  simul¬ 
taneously  and  resulted  in  1 1  casualties  and  85  woundeds.  Since  the  incident,  analysts  have  col¬ 
lected  and  refined  the  information  on  this  terror  operation  (Champagne  et  al.,  2005).  The  meta¬ 
network  regarding  this  incident  is  the  product  of  such  data  collection  and  refinement  by  the  ana¬ 
lysts. 

The  meta-network  has  five  nodesets  and  12  graphs.  Table  4-2  and  Figure  4-1  show  the  overall 
structure  and  basic  statistics  of  the  meta-network.  This  is  a  relatively  small  dataset  compared  to 
the  other  dataset,  a  current  global  terrorist  network.  The  boundary  of  this  network  is  almost  com¬ 
prehensive,  which  means  that  the  analysts  put  almost  all  the  related  entities  in  the  dataset.  This 
aspect  is  different  from  the  opened  boundary  of  the  global  terrorist  network  data,  which  we  do  not 
believe  that  the  dataset  is  comprehensive  and  complete.  The  completeness  of  the  task  network  in 
this  network  particularly  stands  out.  The  task  network  of  the  bombing  procedure  is  well  investi¬ 
gated  and  reviewed  by  analysts  multiple  times,  so  that  the  task  network  is  well  defined  for  further 
analyses  such  as  the  decision  making  structure  extraction  and  influence  network  analysis. 
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Figure  4-1  the  visualization  of  a  terrorist  organization  responsible  for  1998  US  Embassy  Bombing  in  Tanzania.  This  is  a  complex  system,  so  the  differ¬ 
ent  types  of  entities  are  shown  in  different  symbols. 
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Table  4-2  the  overall  structure  of  the  1998  US  Embassy  Bombing  in  Tanzania  and  Kenya  dataset.  5 
nodesets  and  12  graphs.  Mostly,  undirected  graphs  except  the  agent-to-agent  network  and  task-to- 
task  network.  The  density  of  the  existing  graphs  are  specified  as  the  numbers  in  cells,  and  the  missing 
densities  show  that  the  graphs  are  not  in  the  dataset 


Agent 

Expertise 

Location 

Resource 

Task 

Agent 

(18  terrorists) 

0.143 

0.126 

0.200 

0.076 

0.142 

Expertise 
(14  expertise) 

0.071 

0.171 

Location 

(5  locations) 

0.500 

0.107 

0.312 

Resource 

( 1 3  resources) 

0.120 

Task 

(25  tasks) 

0.055 

4.3.  1998  US  Embassy  Bombing  in  Kenya 


1  also  created  another  dataset  that  only  concerns  the  Kenya  bomb  detonation,  which  means  that  I 
extracted  organizational  elements  related  to  Kenya  and  excluded  organizational  elements  only 
related  to  Tanzania.  This  dataset  is  generated  to  analyze  the  individual  bomb  detonations  of  the 
above  series  of  attacks.  Table  4-3 


shows  the  basic  statistics  of  this  sub  network,  and  Figure  4-2 


is 


the  overall  visualization. 


Table  4-3  the  meta-matrix  of  the  dataset,  a  terrorist  group  responsible  for  1988  US  embassy  bombing 
in  Kenya.  The  density  of  the  existing  graphs  are  specified  as  the  numbers  in  cells,  and  the  missing 
densities  show  that  the  graphs  are  not  in  the  dataset 


Agent 

Expertise 

Location 

Resource 

Task 

Agent 

(16  terrorists) 

0.141 

0.070 

0.156 

0.101 

0.139 

Expertise 
(8  Expertise) 

0.062 

0.048 

Location 

(4  locations) 

0.500 

0.093 

0.230 

Resource 

(8  resources) 

0.076 

Task 

(13  tasks) 

0.108 
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Figure  4-2  the  visualization  of  the  meta-matrix  of  the  terrorist  group  responsible  for  the  1988  US  embassy  bombing  in  Kenya 


CMU  SCS  ISR 


-55- 


CASOS  Report 


4.4.  Global  terrorist  network 


A  current  global  terrorist  network  is  a  dataset  aggregating  all  the  available  terrorism  related  data¬ 
sets  at  CASOS  lab,  CMU.  Each  of  the  sub  datasets  is  from  a  single  incident  or  a  short  time  period 
of  a  terrorist  organization,  and  a  database  system  merges  the  nodes  and  sum  up  the  links.  The  ori¬ 
gins  of  the  sub  datasets  include  human  analysts,  network  text  analysis  (Carley,  1997)  and  ex¬ 
tracted  networks  from  relational  databases.  While  this  dataset  covers  many  of  terrorist  organiza¬ 
tions  around  the  world,  this  is  not  precisely  validated  or  confirmed  because  the  generation  proce¬ 
dure  included  multiple  automatic  data  collection  routines. 


There  are  pros  and  cons  of  this  large  invalidated  dataset.  As  merits,  this  dataset  approximates  the 
global  terrorist  social  relations  and  geospatial  distributions.  Furthermore,  the  dataset  has  enough 
number  of  nodes  and  links  to  test  the  scalability  of  introduced  framework.  As  weaknesses,  this 
dataset  is  not  bounded  by  a  mission-oriented  structure  which  this  analysis  framework  aims  to  ana¬ 
lyze  the  mission  and  task  execution  of  an  organization  and  to  discover  better  ways  to  prevent  the 
executions.  This  dataset  might  be  approached  from  the  sociological  perspective,  rather  than  from 
the  operations  research  perspective.  Finally,  since  the  dataset  is  not  validated,  the  empirical  anal¬ 
ysis  results  should  be  interpreted  only  to  the  extent  of  explaining  the  capability  of  the  suggested 
framework,  not  to  the  extent  of  actual  global  terrorist  network  analysis. 


Figure  4-3 


and 


Table  4-4 


are  the  visualization  and  basic  statistics  of  the  used  global  terrorist  net¬ 


work  dataset.  Particularly,  Figure  4-3  shows  the  geospatial  locations  of  agents,  expertise,  location, 
resources  and  tasks  by  matching  the  coordinates  on  a  world  map. 


Table  4-4  the  meta-matrix  of  the  dataset,  a  terrorist  group  responsible  for  the  global  terrorist  net¬ 
work.  The  density  of  the  existing  graphs  are  specified  as  the  numbers  in  cells,  and  the  missing  densi¬ 
ties  show  that  the  graphs  are  not  in  the  dataset 


Agent 

Expertise 

Location 

Resource 

Task 

Agent 

(597  terrorists) 

0.00161 

0.008989 

0.00423 

0.00333 

0.00835 

Expertise 
(281  Expertise) 

0.06134 

0.05137 

0.05098 

0.07050 

Location 

(471  locations) 

0.01203 

0.06455 

0.09216 

Resource 

(381  resources) 

0.08768 

0.08195 

Task 

(278  tasks) 

0.02067 
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Figure  4-3  the  visualization  of  the  meta-matrix  by  using  OraGIS,  The  clusters  of  nodes  are  represented  as  polygons.  The  nodes  of  meta-network  are 

distributed  across  the  geospatial  regions. 
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5.  Building  Static  Destabilization  Strategies  -  Decision  making  structure  Analysis 


In  today’s  world  there  are  many  organizations  or  groups  that  are  organized  virtually  or  covertly. 
Open  source  project  teams,  teams  in  massive  multi-player  on-line  games,  and  terrorist  organiza¬ 
tions  are  just  a  few  examples.  For  these  organizations,  what  is  known  is  what  can  be  observed. 
What  can  be  observed  are  the  networks  connecting  individuals,  resources,  and  activities  across 
many  lines  and  types  of  communications.  Clearly  there  are  many  types  of  relations  in  this  ob¬ 
served  structure  not  all  of  which  are  necessarily  work  related.  For  these  organizations,  the  orga¬ 
nizational  chart  or  the  operational  structure  is  likely  not  to  be  known  apriori.  Indeed,  it  is  unlikely 
that  there  is  an  operational  structure  in  the  sense  of  a  declaration  by  the  organization  about  who 
reports  to  whom  and  who  is  doing  what.  Nevertheless,  it  is  likely  that  the  operational  structure2  of 
the  organization,  who  shares  information  with  whom,  resolves  issues,  etc.  is  embedded  in  the  ob¬ 
served  structure.  If  we  could  infer  this  operational  structure  from  the  observed  structure  we 
would  have  an  improved  understanding  of  how  work  is  done  in  these  groups,  their  strengths,  and 
their  vulnerabilities3. 


I  propose  an  approach  for  inferring  the  operational  structure  from  the  observed  structure.  The  ob¬ 
served  and  the  operational  structure  are  likely  to  have  distinct  profiles,  e.g.,  key  personnel  and 
clusters  of  individuals.  This  is  because  the  operational  is  focused  only  on  work  related  activities 
whereas  the  observed  is  a  concatenation  of  all  activities,  a  snapshot  of  human  endeavors.  I  illu¬ 
strate  the  efficacy  of  this  approach  using  data  collected  on  a  real-world,  terrorist  organization. 
The  proposed  approach  expands  the  horizon  of  organizational  analysis  by  enabling  researchers  to 
identify  and  assess  these  operational  structures. 


Understanding  an  organization’s  operational  structure  is  critical  when  we  attempt  to  understand, 
intervene  in,  or  manage  the  organization  (Child,  1973).  However,  organizational  structures  in  the 
real  world  often  differ  from  their  recognized  operational  structure  (Meyer  and  Rowan,  1977),  and 
sometimes  its  membership  conceals  the  operational  structure  with  various  types  of  social  interac¬ 
tions  and  communications  (Shetty  and  Abidi,  2005).  Furthermore,  when  we  observe  the  actual 
social  interactions  among  the  members  of  the  group,  the  observed  social-network  data  are  often 
noisy,  and  contain  misleading  and  uncertain  links  (Borgatti  et  ah,  2006).  This  is  especially  true 


2  The  definition  of  operational  Structure  Of  an  organization  may  be  different  from  analysts’  viewpoint  and 
used  theories  in  the  discussion.  I  define  an  operational  Structure  Of  an  organization  as  an  organizational 
structure  (including  the  information  processing  relations;  and  the  command  and  control  relations)  among 
human  actors  to  complete  a  specific  operation  (or  a  task  or  a  mission). 

3  Human  analysts  have  qualitative  ideas  about  how  adversarial  organizations  might  process  information, 
task  dependencies  or  command  orders.  From  these  qualitative  ideas,  I  could  construct  a  set  of  heuristics 
inferring  information  processing  and  decision  making  structure  embedded  in  an  observed  social  network. 
The  meaning  of  “an  improved  understanding  of  how  work  is  done”  is  that  such  qualitative  ideas  can  be 
improved  and  updated  by  reasoning  an  actual  organization  with  the  approach  (built  upon  the  current  qualit¬ 
ative  ideas)  introduced  in  this  chapter.  Simultaneously,  the  usage  of  the  approach  may  improve  our  empiri¬ 
cal  understanding  of  the  analyzed  organization. 
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from  an  organizational  task  perspective.  1  described  such  differences  between  social  relations  and 
operational  relations  in  three  scenarios  introduced  in  Chapter  1.2. 


In  the  scenarios  in  Chapter  1.2.,  1  identify  a  variety  of  different  structures  that  vary  in  their  boun¬ 
daries  and  explicitness.  First,  the  organizational  chart  unequivocally  outlines  the  operational  hie¬ 
rarchical  structure,  but  the  employees  have  another  hierarchical  reporting  structure  (Scenario  2,  in 
Ch.  1.2.)  that  is  not  shown  in  the  operational  chart.  Both  of  these  speak  to  the  organizational  tasks 
but  neither  is  the  specific  structure  for  a  specific  task.  I  use  the  term  decision  making  organiza¬ 
tional  Structure,  to  refer  to  the  structure  that  relates  only  to  a  specific  organizational  task:  it  in¬ 
cludes  only  task  relevant  personnel  and  the  related  work  relationships,  relevant  to  working  on, 
communicating  about,  and  completing  that  particular  task.  Second,  for  example,  email  accounts 
show  contacts,  regardless  of  the  contacts’  importance  or  the  nature  of  the  work  relations,  so  the 
uncovered  email  transaction  structure  contains  at  the  same  time  people  with  critical  work  rela¬ 
tionships  and  ones  with  insignificant  relationships  from  an  organizational  task  perspective. 
Another  observed  structure  is  the  social  network,  or  informal  structure,  the  set  of  observable  so¬ 
cial  interactions  among  individuals.  However,  our  observations  about  multiple  relationships  may 
look  same,  but  the  actual  nature  of  relationships  may  be  different  ranging  from  kinship,  friendship, 
money  lending,  to  work  relations.  Often,  when  analysts  rely  on  the  observed  social  interactions 
between  two  social  entities,  they  may  put  the  interaction  links  without  any  distinction  of  the  na¬ 
ture  of  the  interactions  because  the  interaction  motives  might  not  be  clear.  I  use  the  term  observed 
Structure,  to  refer  to  the  structure  that  is  observed  and  may  contain  information  other  than  organi¬ 
zational  task  information. 


These  different  structures  can  be  also  seen  in  diverse  organizations,  i.e.  grass-roots  organizations, 
self-organizing  clubs,  startup  companies,  terrorist  networks,  military  command  and  control  struc¬ 
tures,  and  so  on.  For  my  purposes,  the  key  is  that  each  of  these  structures  can  be  represented  as  a 
network  of  implicit  relations  including  significant  operational  structures  as  well  as  insignificant 
social  relations.  Then,  my  approach  extracts  the  operational  structures  out  of  mixed  observed  re¬ 
lations. 


For  observed  structures,  the  key  methodological  approach  is  social  network  analysis.  Social  net¬ 
work  analysis  (Wasserman  and  Faust,  1994;  Borgatti  and  Everett,  1992)  concentrates  on  finding 
key  personnel,  e.g.  which  boss  is  more  important  in  Scenario  2  in  Ch.  1.2.  Or,  social  network 
analysis  can  be  used  to  find  clusters,  i.e.  clusters  of  developers  of  the  open-source  development 
team  in  the  same  scenario.  For  decision  making  structures,  the  key  methodological  approach  is 
decision  making  structure  analysis.  Decision  making  structure  analysis  (Levis,  2005;  Huber, 
1990;  Alberts  and  Hayes,  2003)  uncovers  the  information  and  response  transmissions  in  mem¬ 
bers’  cognitive  processes  while  a  decision  is  made,  i.e.  when  a  employee’s  report  weighs  in  the 
operational  or  informal  bosses’  decision  making  processes  in  Scenario  2  in  Ch.  1 .2,  or  to  what 
extent  an  open  source  software  developer  and  his  discussion  partner  share  the  information  and 
when  in  Scenario  3  in  Ch.  1.2.  These  are  distinct  methodological  approaches  each  contributing 
to  our  understanding  of  these  groups  and  organizations. 
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We  could  enhance  our  understanding  if  we  could  link  these  two  approaches  and  move  easily  from 
one  methodology  to  the  other  on  the  same  data.  We  can  combine  the  approaches  in  many  ways, 
i.e.  regarding  a  critical  organizational  structure  as  a  decision  making  structure  and  applying  social 
network  analysis  to  the  structure  (applying  social  network  analysis  to  a  decision  making  struc¬ 
ture).  Or,  we  can  see  the  observed  network  as  a  decision  making  structure  and  estimate  the  cogni¬ 
tive  processes  of  members  of  the  network  (applying  decision  making  structure  analysis  to  a  dy¬ 
namic  network).  In  this  chapter,  I  introduce  an  integrative  approach  that  is  particularly  valuable 
when  the  decision  making  structures  are  never  formally  defined.  First,  I  extract  the  decision  mak¬ 
ing  organizational  structure  from  an  observed  meta-network  of  a  target  organization.  For  instance, 
I  extract  the  only  relevant  people  in  the  decision  making  processes  among  terrorists’  contacts  in 
Scenario  1  in  Ch.1.2.  This  extraction  is  done  by  considering  the  work  relationships  among  the 
members  of  the  group  and  the  work  flow  of  the  organizational  objective.  Next,  I  analyze  the  ex¬ 
tracted  decision  making  structure  with  the  social  network  analysis  approach.  For  example,  among 
the  three  bosses  and  an  employee  in  Scenario  2  in  Ch.1.2, 1  identify  the  most  important  personnel 
in  terms  of  information  delivery,  situation  cognition,  linking  to  others,  by  utilizing  social  network 
metrics.  Then,  we  can  see  the  different  key  personnel  lists  and  clustered  members  between  the 
observed  meta-network  and  the  extracted  decision  making  structure.  These  differences  imply  that 
the  analysis  result  can  be  richer  if  we  investigate  not  only  the  observed  network,  but  also  the  in¬ 
ferred  decision  making  structure.  The  decision  making  structure  extraction  will  reduce  or  limit  the 
relevant  personnel  in  the  social  network,  will  help  set  the  scope  of  investigations,  and  produce 
various  analysis  results  from  different  decision  making  structure  viewpoints.  This  is  particularly 
valuable  when  dealing  with  terrorists,  grass  roots,  or  open  source  groups  as  those  groups  can  be 
quite  large  so  that  finding  a  particular  organizational  task  structure,  without  computational  aid, 
can  be  rather  like  finding  a  needle  in  a  haystack. 


I  illustrate  my  approach  using  data  on  the  terrorist  organization  responsible  for  the  bombing  inci¬ 
dents  in  Kenya  and  Tanzania  (see  Dataset  introduction  in  Chapter  4.2). 


5.1.  Background  about  Integration  of  Dynamic  Network  and  Decision  Making 
Structure  Analyses 


The  key  to  integrating  these  two  approaches  is  to  move  beyond  standard  social  network  analysis 
to  a  more  dynamic  network  analysis  with  a  focus  on  not  just  the  social  network  but  the  meta¬ 
network  (Krackhardt  and  Carley,  1998;  Carley,  2006a).  The  meta-matrix  concept  is  already  in¬ 
troduced  in  Ch.  4. 1 .  This  section  describes  two  phases  in  this  integrated  framework.  Phase  1  is 
inferring  a  decision  making  structure  from  a  meta-network.  Phase  2  is  using  network  metrics  to 
assess  the  extracted  structure  and  identify  points  of  vulnerability.  Each  of  these  phases  is  de¬ 
scribed  in  turn  afterward. 

5.1.1.  Inferring  a  decision  making  structure  from  a  complex  system  of  an  organi¬ 
zation 
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The  organizations  of  interest  in  this  paper  exhibit  the  characteristics  of  a  complex  system.  Ac¬ 
cording  to  Morel  and  Ramanujam  (1999),  there  are  two  commonly  observed  characteristics  of  a 
complex  system:  a  large  number  of  interacting  elements  and  emergent  properties.  First,  a  corpo¬ 
rate  organizational  structure  consists  of  a  large  number  of  interacting  elements  such  as  workers, 
information,  expertise,  and  resources  (Grant,  1996).  These  elements  should  be  assigned  and  dis¬ 
tributed  properly  to  perform  tasks,  and  such  assignments  and  distribution  relationships  are  the 
organizational  structure  of  the  corporation.  Similarly,  a  terrorist  network  is  a  collection  of  hetero¬ 
geneous  entities  interacting  with  and  assigned  to  each  other.  Though  a  traditionally  terrorist  net¬ 
work  was  regarded  as  a  simple  terrorist-to-terrorist  network  (Krebs,  2002;  Mayntz,  2004),  recent 
observations  and  analyses  (Carley,  2006;  Sageman,  2004)  assert  that  the  terrorist  network  in¬ 
cludes  bomb  materials,  reconnaissance  on  targets,  as  well  as  terrorists. 


Second,  the  organizations  of  interest  have  emergent  properties.  According  to  Thompson  (1967), 
synthetic  organization  is  an  organization  established  after  a  major  event,  such  as  a  disaster.  The 
organization  emerges  around  operationally  designated  offices  by  linking  NGOs  and  relevant 
groups  to  the  offices.  The  organization  self-organizes  the  work  relationships  and  seeks  a  better 
structure  over  the  course  of  the  event.  This  emerging  structure  concept  can  also  be  applied  to  cor¬ 
porate  and  terrorist  network  domains.  Employees  of  a  corporation  have  their  superiors  and  take 
orders  from  them,  as  in  a  hierarchical  organization,  but  they  also  keep  and  follow  work  relation¬ 
ships  in  practice.  Also,  it  is  often  seen  that  a  task-force  team  emerges  before  or  after  important 
events  (Nonaka,  1997).  This  task-force  team  shows  the  emergent  properties  of  the  organizational 
structure  in  a  corporation.  Additionally,  terrorist  networks  frequently  show  the  emergent  proper¬ 
ties  by  adapting  their  structures  to  situations  (Schilling  and  Phelps,  2007;  Elliot  and  Kiel,  2003). 

If  the  organizations  in  focus  are  complex,  we  should  find  a  decision  making  structure  by  consi¬ 
dering  the  various  types  of  interacting  elements  and  the  adaptive  nature  of  the  structure.  At  the 
same  time,  since  the  traditional  organizational  structure  is  defined  as  a  structure  managing  indi¬ 
viduals  in  an  organization,  the  found  structure  should  contain  people -to-people  relationships. 
Thus,  we  focus  on  developing  a  model  that  takes  the  complex  nature  into  consideration  and  gene¬ 
rates  a  set  of  work  relationships  among  the  individuals. 


CAESAR  111  (Levis,  2005;  Kansal  et  al.,  2007)  is  a  discrete  event  dynamical  model  that  focuses 
on  the  information  and  decision  making  processes  in  organizations.  The  individual  members  of 
the  organization  interact  with  other  organization  members  and  with  the  environment  through  a 
network  of  various  types  of  links  that  differ  in  content  depending  on  which  internal  cognitive 
process  generates  them.  Thus,  the  model  is  similar  to  our  approach.  Therefore,  our  major  effort  in 
this  paper  is  inferring  the  links  of  the  cognitive  processes  among  individuals  from  a  meta-network. 

5.1.2.  Assessing  vulnerabilities  and  criticalities  of  the  organizational  structure 

There  have  been  a  number  of  approaches  in  evaluating  the  organizational  structures.  For  instance, 
traditional  management  science  developed  qualitative  evaluation  criteria  (Smircich,  1983).  How¬ 
ever,  though  these  qualitative  examinations  are  insightful,  the  qualitative  approaches  have  prob¬ 
lems.  They  are  not  scalable  to  large  and  complex  organizations,  nor  applicable  to  various  discip- 
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lines,  and  nor  designed  to  assess  the  complex  representation  of  a  meta-network.  Therefore,  in  this 
paper,  we  will  use  a  quantitative  model. 


Social  network  analysis  has  been  one  of  the  most  useful  tools  in  analyzing  organizational  struc¬ 
tures,  i.e.  corporate  structures  and  terrorist  networks  (Floyd  and  Wooldridge  1999;  Krebs  2002). 
It  is  able  to  find  key  personnel  (Borgatti  and  Everett  1992)  and  embedded  clusters.  Also,  it  as¬ 
sesses  the  characteristics,  such  as  degree  of  centralization  and  levels  of  hierarchy,  of  the  organiza¬ 
tions.  Gabbay  and  Leenders  (2001)  link  the  social  network  analysis  to  the  management  of  social 
capital  of  a  corporation.  Also,  Reagans  and  Zuckerman  (2001)  investigate  the  performances  of 
various  corporate  R&D  teams  with  social  network  analysis.  This  analysis  is  used  not  only  in  the 
corporate  domains,  but  also  in  the  counterterrorism  field,  and  Kreb  (2002)  visualized  the  terrorist 
network  responsible  for  the  9/11  attacks  and  calculated  the  social  network  centrality  metrics  of 
terrorists. 


In  this  work,  we  follow  the  basic  approach  of  social  network  analysis,  which  involves  calculating 
the  social  network  metrics  and  finding  key  entities  in  the  structure.  However,  we  are  different 
from  the  traditional  social  network  analysis  in  two  ways.  One  way  is  that  we  analyze  both  the 
observed  meta-network  and  inferred  decision  making  structure.  The  other  way  is  that  we  use  a 
couple  of  metrics,  cognitive  demand  and  communication  (Carley,  2002) — which  are  not  common 
in  social  networks,  but  insightful  in  examining  a  complex  organization.  Furthermore,  we  use  QAP 
and  MRQAP  analysis  techniques.  These  techniques  have  been  used  to  correlate  two  networks  and 
regress  one  network  against  another.  We  correlate  the  inferred  structures  to  the  observed  structure 
to  examine  to  what  extent  the  extracted  ones  are  embedded  in  the  observed  ones. 


5.2.  Method 


My  framework  is  about  extracting  a  decision  making  structure  from  the  meta-network  of  an  or¬ 
ganization  as  well  as  analyzing  and  comparing  the  extracted  structure  and  the  observed  meta¬ 
network.  In  this  section,  I  introduce  how  to  infer  a  potential  decision  making  structure  in  the  first 
stage  and  network  metrics  in  the  second  stage. 


While  the  analysis  procedures  are  largely  in  two  steps,  there  are  five  detailed  stages  in  this  analy¬ 
sis  framework.  The  extraction  requires  three  stages.  First,  I  obtain  a  target  organization  to  analyze 
and  its  task  of  interest.  Second,  I  identify  the  sub-task  network  by  including  only  relevant  tasks  to 
the  completion  of  the  task  of  interest,  and  this  leads  to  limiting  the  personnel  involved.  Third,  the 
target  organization  is  examined  from  three  perspectives:  information  sharing,  result  sharing,  and 
command  interpretation.  Each  of  the  examinations  generates  a  decision  making  structure  corres¬ 
ponding  to  the  perspective. 


The  analysis  and  comparison  are  done  in  two  steps.  First,  I  compare  the  extracted  structure  to  the 
observed  network.  Additionally,  I  estimate  to  what  extent  I  can  recreate  the  observed  structure 
with  the  extracted  ones.  These  comparisons  show  the  effectiveness  and  the  usefulness  of  the  ex- 
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traction  overall,  since  I  expect  the  extracted  structure  to  be  based  on  the  meta-network,  but  not  be 
exactly  the  same  structure.  Second,  we  evaluate  the  network  metrics  of  individuals,  identify  the 
key  personnel,  and  see  the  differences  between  the  key  personnel  list  from  the  observed  and  the 
extracted  structures. 


This  framework  is  also  designed  to  convert  the  meta-network  into  an  input  dataset  for  CAESAR 
III,  the  software  implementation  of  the  information  processing  and  decision  making  model  of  an 
organization.  While  we  discuss  and  experiment  inferring  a  structure  for  CAESAR  III  from  a  me¬ 
ta-network,  we  do  not  utilize  CAESAR  111  to  analyze  the  extracted  model  from  its  viewpoint.  Our 
evaluation  analysis  is  limited  to  social  network  approaches. 


L _ I 


Figure  5-1  The  procedure  of  the  introduced  analysis  framework 

5.2.1.  Extracting  a  decision  making  structure  from  a  meta-network 

The  scope  of  the  decision  making  structure  is  limited  by  focusing  on  a  single  task  execution.  This 
way  restricts  the  number  of  individuals  who  make  up  the  extracted  structure  and  makes  the  others 
as  the  outside  collaborators.  As  the  number  of  individuals  of  interests  decreases,  we  can  focus  on 
the  investigation  of  the  specific  task  performance  and  keep  the  generated  structure  recognizable 
to  human  analysts.  Also,  in  the  management  science  community,  these  selected  individuals  are 
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regarded  as  decision  makers,  so  this  limitation  differentiates  between  a  social  agent  and  a  deci¬ 
sion  maker  in  the  structure. 

After  selecting  the  decision  makers,  1  infer  the  various  management  relations  by  utilizing  the  so¬ 
cial  network  as  well  as  the  task  assignment,  the  information,  and  the  resource  distribution  net¬ 
works.  For  instance,  when  two  members  are  connected  with  a  communication  path  and  one  has 
expertise  required  by  the  other,  the  shortest  path  may  be  the  information  sharing  path  in  terms  of 
management  relationships.  With  similar  methods,  in  addition  to  the  information  sharing  relation¬ 
ships,  we  infer  result  sharing  and  command  interpretation  relationships.  These  are  originated  from 
three  different  structural  links  in  the  CAESAR  III  model.  In  the  model,  information  sharing,  re¬ 
sult  sharing,  and  command  interpretation  links  are  different  in  their  timings  of  message  arrival. 
Information  sharing  messages  are  delivered  after  the  sender  is  aware  of  the  situation  and  before 
the  receiver  performs  the  information  fusion.  Result  sharing  is  done  after  the  sender’s  response 
selection.  Command  interpretation  occurs  before  the  receiver’s  response  selection.  The  informa¬ 
tion  fusion,  response  selection,  and  command  interpretation  are  the  cognitive  processes  defined  in 
CAESAR  III. 

5.2.1. 1.  Limiting  a  task  network  and  finding  decision  makers 

Since  the  decision  making  structure  in  this  paper  is  task-oriented,  our  framework  aims  to  extract  a 
structure  responsible  for  completing  a  certain  final  task.  This  task  is  a  user-defined  parameter. 
With  the  given  final  task,  we  can  retrace  a  sub-task  network  from  a  meta-network  by  following 
the  prerequisite  tasks  repeatedly,  starting  from  the  final  task.  For  example,  in  Figure  5-2  the  final 
task  is  lead  attackers  to  embassy,  then,  its  sub-prerequisite  tasks  are  provide  money,  surveillance 
of  possible  targets,  education  and  training,  etc  (Total  8  tasks).  These  eight  tasks  consist  of  the 
sub-task  network  for  extraction,  and  the  8  terrorists  ( Abdullah  Ahmed  Abdullah,  Al  Owa/i,  Abdel 
Rahman,  etc)  assigned  to  those  tasks  are  the  decision  makers  of  this  task-oriented  decision  mak¬ 
ing  structure. 
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^Abdullah  Ahmed  Abdullah 

/  T 


jAI  Owali 


.Abdel  Rahman 
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.Ali  Mohammed 

List  of  Involved  Decision 

Makers 


Figure  5-2  The  partial  visualization  of  the  task  precedence  network  (task-to-task)  and  the  task  as¬ 
signment  network  (terrorist-to-task).  The  dashed  line  represents  the  separation  of  the  task  network 
and  the  assigned  agents.  When  users  set  up  lead  attackers  to  embassy  as  a  final  task  for  the  extrac¬ 
tion,  the  visualized  tasks  and  the  individuals  are  the  components  of  the  sub-task  network,  and  the 
accompanying  decision  makers,  65especttively. 


After  limiting  the  involved  decision  makers,  I  aggregate  the  uninvolved  agents  as  an  outside  or¬ 
ganization.  It  is  typical  to  see  a  decision  making  structure  interacting  with  outside  organizations. 
If  we  configure  a  task-based  sub-decision  making  structure,  some  of  the  individuals  will  be  ex¬ 
cluded,  since  they  are  not  doing  the  tasks  in  the  sub-task  network.  However,  it  is  still  possible  that 
the  excluded  ones  hold  required  resources  or  information,  and  this  will  require  communications 
between  the  selected  decision  makers  of  the  extracted  structure  and  the  outside  organization, 
which  is  the  group  of  the  excluded  individuals.  Thus,  finding  assigned  decision  makers  does  not 
just  limit  the  personnel  of  the  decision  making  structure,  but  also  specifies  the  boundary  decision 
makers  interacting  with  outside  entities.  In  this  example,  we  have  a  total  1 8  terrorists,  and  1 6  ter¬ 
rorists  are  selected  as  decision  makers.  Thus,  the  other  2  terrorists  form  the  outside  organization 
of  this  decision  making  structure  (It  should  be  noted  that  these  two  agents  were  identified  as  iso¬ 
lates  and  had  no  specific  relations  with  decision  makers  when  we  limit  our  investigations  to  the 
detonate  task). 

5.2. 1.2.  Information  sharing  structure 


In  a  meta-network,  a  piece  of  information,  or  expertise,  is  represented  as  a  knowledge  node.  Thus, 
we  assume  that  producing  information  is  represented  as  a  link  from  an  agent  node  to  a  knowledge 
node.  Also,  we  infer  that  one  decision  maker  will  acquire  information  through  an  information 
sharing  path  if  1)  he  needs  the  information  to  perform  his  assigned  tasks,  2)  he  does  not  have  the 
information,  and  3)  the  information  sharing  path  is  the  shortest  path  from  the  nearest  decision 
maker  holding  the  infonnation  for  him.  The  figures  from  Figure  5-3  to  Figure  5-7  describe  the 


case  of  information  sharing  links.  According  to  the  sub-network  in  the  figures,  AH  Mohamed is 
assigned  to  surveillance  of  possible  targets,  which  requires  surveillance  expertise.  However,  sur- 
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veil  lance  expertise  is  not  available  to  Aii  Mohammed,  but  available  to  Anas  Al- Li  by.  Then,  AH 
Mohamed  finds  shortest  paths  possible  to  Anas  Ai-Liby,  and  he  finds  the  shortest  paths  with  two 
social  links  going  through  Osama  bin  Laden  or  Muhammad  Atef.  Then,  the  links  in  these  two 
shortest  paths  will  be  the  information  sharing  links. 


surveillance_expertisec 


|Surveillance_of_possible_targets&. 


0Anas  al-Liby 


^Muhammed  Atef 
o0sama  Bin  Laden 

- 

'^Ali  Mohammed  ( 


Figure  5-3  A  partial  visualization  explaining  the  formation  of  information  sharing  links:  First  step, 

find  assigned  tasks  of  an  agent 


surveillance_expertisec 


\  surveillance_of_possible_targetsy.  / 


?Anas  al-Liby 

^Muhammed  Atef 
0Osama  Bin  Laden 

<^AIi  Mohammed 


Figure  5-4  Second  step,  find  required  expertise  or  resources  that  the  agent  does  not  have4 


4  Recognize  that  surveillance  expertise  is  required  to  perform  the  assigned  task  and  A//'  Mohamed  doesn’t 
have  it 
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Figure  5-5  Third  step,  the  organization  searches  an  agent  with  the  required  expertise  or  resources 

from  the  agents  executing  the  task5 


( 

[  surveillance_expertise0. 


surveillance_of_possible_targets?£ 


fAnas  al-Liby  ( 

______  .X 

^Muhammed  Atef 
oOsama  Bin  Laden 

^Ali  Mohammed 


Figure  5-6  Fourth  step,  the  agent  with  the  required  resources  or  expertise  has  to  deliver  it  to  the 
agent  assigned  to  task  without  the  required  elements  through  the  social  links6 


surveillance_expertise0. 


surveillance_of_possible_targetsj£ 


Figure  5-7  Fifth  step,  the  found  shortest  paths  for  expertise  or  resource  deliveries  there  are  informa¬ 
tion  sharing  links.7 


5  Search  an  agent  with  surveillance  expertise  from  the  nearest  agents  through  the  social  network  of  agents. 
Stop  searching  when  Anas  al-Liby,  two  links  away,  has  it 

6  Anas  al-Liby  has,  surveillance  expertise,  and  he  has  to  provide  the  expertise  through  the  social  network 
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5.2. 1.3.  Result  sharing  structure 


Result  Sharing  (RS)  is  communication  from  a  decision  maker  finishing  his  assigned  task  to  a  de¬ 
cision  maker  with  a  task  that  required  the  previously  done  task.  For  instance,  there  is  a  RS  com¬ 
munication  from  a  terrorist  who  finished  surveillance  of  possible  targets  to  a  terrorist  who  will 
perform  overall  planning  and  execution.  Figure  5-8  shows  the  above  two  tasks  and  their  assigned 
agents.  Surveillance  of  possible  targets  has  three  assigned  agents,  and  overall  planning  and  ex¬ 
ecution  has  eight  agents.  Then,  there  will  be  16  result  sharing  links  originating  from  the  four 
agents  (AH  Mohammed,  At  Owaii,  Anas  ai-Liby,  and  Abdullah  Ahmed  Abdullah)  to  the  four 
agents  ( Abdel  Rahman,  Wadih  el -H age,  Mu  hammed  Ate  1  and  Osama  Bin  Laden),  excluding  the 
agent  who  is  assigned  to  the  next  task  and  already  knows  the  results  of  the  previous  task. 


Ali  Mohammed 


Al  Owalfr 


A  result  sharing  link  exist  from  any 
agent  of  the  left  group  to  any  agent  of 
the  right  group 


nAbdel  Rahman 


Doesn't  need  a  result  sharing  link 
from  the  agents  of  the  left  group  to 
the  group  assigned  to  both  tasks, 
since  the  agents  doing  both  tasks 
know  the  results  of  the  previous  task 


% 


^i/Vadih  el-Hage 
'  Muhammed  Atef 


Anas  al-Liby^ 


^Osama  Bin  Laden 


surveillance_of_possible_targetST,* 


\  Need  a  result  sharing  link  from 

*  —  —  —  —  —  —  —  the  group  assigned  to  both 

I  tasks  to  the  agents  of  the  right 

^Abdullah  Ahmed  Abdul  group,  since  the  agents  doing 

.  —  f  both  tasks  know  the  results  of 

the  previous  task 

_ £,-'overall_planning_and_execution 


Figure  5-8  A  partial  visualization  of  two  tasks  and  ten  assigned  agents.  This  precedence  task  relation 
will  result  in  21  result  sharing  links  between  the  agents  doing  the  prior  task  and  the  agents  perform¬ 
ing  the  next  task.  One  agent  who  is  doing  both  does  not  need  any  result  sharing  link. 


5.2. 1.4.  Command  interpretation  structure 

Command  Interpretation  (Cl)  is  command  relation  from  a  decision  maker  who  completed  his  task 
and  sent  an  order  to  a  lower  ranking  decision  maker.  We  infer  this  relation  by  reconstructing  the 
hierarchy  in  the  social  network  based  on  the  direction  of  agent  communication  links.  We  assume 
that  the  directions  of  communications  are  the  representation  of  who-reports-to-whom  relation. 
Subsequently,  the  directions  will  provide  a  basis  for  extracting  hierarchical  structure.  For  instance, 
Ahmed  the  German  has  a  one-way  link  to  Abdullah  Ahmed  Abdullah,  and  K ha  I  fan  K ham  is  Mo- 
hamed  to  Mohammed  Odeh.  These  one-way  social  links  imply  a  command  chain.  On  the  other 

7  Identify  the  expertise  access  paths,  all  possible  shortest  path  from  Anas  a l-L  / by  to  AH  Mohamed.  Each  of 
the  links  in  the  paths  are  information  sharing  links. 
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hand,  Khalfan  Khamis  Mohamed,  Mustafa  Mohamed  Fadhil and SheikAhmed Salim  Swedan  has 
a  cycle  of  communication  Report-Ins.  This  makes  no  command  interpretation  relations  among  the 
three  terrorists.  This  is  because  any  of  the  three  terrorists  can  influence  the  others  by  using  in¬ 
direct  reports.  However,  the  one-way  communication  ensures  that  the  influence  is  just  one  way, 
not  bi-directional. 


V'  level  from  the  hierarchy 


Cycle  makes  no  Command 

Interpretation  relations 


Khalfan  Khamis  Mohamed 

2nd  level  from  the  hierarchy 

Sheik  Ahmed  Salim  Swedan,-^ 

Mustafa  Mohamed  Fadhil^ 


Command  Interpretation 

without  any  relation  cycles 


Ahmed  the  German 


Mohammed  Odeh 


Command  Interpretation  structure 

is  from  the  hierarchical  aspect  of  Wadih  el-Hage^ 
the  social  network.  The  hierarchy 
can  be  defined  by  utilizing  the 
directions  of  social  links. 


JrAbdullah  Ahmed  Abdullah 


Figure  5-9  a  partial  visualization  of  the  agent-to-agent  network.  From  the  directions  of  links,  we  can 
identify  the  hierarchy  of  the  network.  After  configuring  the  hierarchy,  we  can  see  the  Command  In¬ 
terpretation  relations  between  two  agents  at  the  adjacent  level. 


5.2.2.  Assessing  a  network  structure  with  measures 


The  observed  meta-network  and  the  inferred  decision  making  structures  are  all  in  the  meta-matrix 
format.  Therefore,  we  apply  network  analysis  metrics  to  assess  the  criticality  of  individuals  in  a 
network.  The  metrics  are  five:  Degree  centrality,  Betweenness  centrality,  Eigenvector  centrality, 


Cognitive  demand,  and  Communication.  The  detailed  interpretation  is  in  Table  5-1 


Table  5-1  Three  traditional  centrality  metrics  and  two  dynamic  network  metrics  used  to  assess  the 
criticalities  of  individuals  in  the  structure 


Name 

Interpretation 

Reference 

Degree  Central- 

Number  of  in-coming  and  out-going  links  from  a  node, 

Freeman, 

ity 

Degree  of  direct  influence  to  others 

1979 

Betweenness 

Number  of  shortest  paths  passing  a  node,  Degree  of  in- 

Freeman, 

Centrality 

formation  flow  control 

1979 

Eigenvector 

Calculates  the  eigenvector  of  the  largest  positive  eigenva- 

Bonacich, 

Centrality 

lue  of  the  adjacency  matrix,  Degree  of  connections  to  the 
high-scoring  nodes 

1972 

Cognitive  De¬ 
mand 

Measures  the  total  amount  of  effort  expended  by  each 
agent  to  do  his/her  tasks,  calculation  details  are  elabo- 

Carley,  2002 
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rated  below. 

Communication 

Measures  the  communication  need  of  agents  to  complete 
their  assigned  tasks,  calculation  details  are  elaborated  be¬ 
low. 

Carley,  2002 

5.3.  Application 


The  described  decision  making  structure  extraction  scheme  is  applied  to  the  datasets  introduced 
in  Chapter  4. 1  outline  the  application  result  from  the  U.S.  embassy  bombing  in  the  Tanzania  and 
Kenya  case  in  this  chapter.  The  other  results  can  be  found  in  Appendix  1 1.  To  analyze  the  Tanza¬ 
nia  and  Kenya  case,  the  task  of  interest  was  detonation.  Next,  we  regress  the  decision  making 
structures  against  the  observed  meta-network  structure  to  find  which  decision  making  structure  is 
embedded  in  the  observed  network  and  to  what  extent.  After  estimating  the  overall  correlation 
level  between  the  observed  and  the  extracted  structures,  we  describe  and  visualize  the  extracted 
structure.  Next,  we  calculate  five  network  metrics  on  the  observed  meta-network  and  three  differ¬ 
ent  management  networks.  Comparisons  on  the  calculated  metrics  provide  an  insight  into  who 
stands  out  in  different  settings  and  why.  Also,  we  identify  the  clusters  based  on  the  factor  analy¬ 
sis  of  the  metrics  of  the  four  networks. 


5.3.1.  Initial  result  and  descriptive  statistics 


Figure  5-10  is  the  visualization  of  the  extracted  decision  making  structures  for  the  detonation  task, 


and  the  image  is  generated  by  ORA  (Reminga  and  Carley  2004).  The  collection  of  these  extracted 
networks  is  an  input  dataset  for  the  CAESAR  III  model,  and  subsequent  cognitive  process  analy¬ 
sis  in  decision  making  structure  can  be  done  with  the  model.  However,  we  leave  the  analysis  as 
our  future  work  in  this  paper.  Whereas  the  observed  meta-network  has  1 8  members,  the  extracted 
structure  has  only  16.  The  removed  members  are  not  related  to  the  task  network  of  detonation. 
The  topologies  of  the  structures  are  different.  First,  the  information  sharing  structure  is  somewhat 
similar  to  the  person-to-person  network  of  the  meta-network.  The  inference  of  the  information 
sharing  is  done  by  trimming  the  links  not  included  in  the  information  passage.  Therefore,  the  base 
of  the  information  sharing  is  the  person-to-person  network  (social  network),  so  the  inferred  net¬ 
work  resembles  the  social  network.  Second,  the  result  sharing  network  is  very  different  from  the 
social  network.  The  result  sharing  is  inferred  from  the  task  dependency  network  and  task  assign¬ 
ment  network.  Due  to  the  difference  between  the  result  sharing  structure  and  the  social  network, 
this  organization  may  suffer  from  the  delivery  of  information  about  the  completion  of  prerequi¬ 
sites  during  the  task  execution  period.  Finally,  the  command  interpretation  structure  only  includes 
three  individuals.  In  the  observed  social  network,  most  of  the  individuals  are  linked  by  a  cycle 
with  directed  links.  Therefore,  the  inference  on  the  command  interpretation  is  not  clear  for  most 
of  the  members.  However,  we  can  observe  several  hierarchical  relations  such  as  Ahmed  the  Ger¬ 
man  to  Abdullah  Ahmed  Abdullah,  K ha  I  fan  K ham  Is  Mohamed  to  A!  Owali,  etc. 
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Figure  5-10  Three  extracted  decision  making  structures.  (Top)  Information  sharing,  (Middle)  Result 

sharing,  (Bottom)  Command  interpretation 
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5.3.2.  Embedded  decision  making  structures  in  an  observed  meta-network 


We  analyze  how  the  extracted  decision  making  structure  was  embedded  in  the  observed  meta¬ 
network  and  to  what  extent.  We  use  the  QAP/MRQAP  technique  to  compare  and  to  regress  the 
extracted  decision  making  structures  to  the  observed  network.  This  is  a  statistical  analysis  to  sup¬ 
port  the  qualitative  findings  of  Section  5.3.1.  If  the  meta-network  implies  such  decision  making 
structures,  the  correlation  and  the  R-square  of  the  regression  result  will  be  high.  Table  5-2  dis¬ 
plays  the  result  of  QAP  correlations  between  each  of  the  extracted  structures  and  the  meta¬ 
network.  Information  sharing  is  very  highly  correlated  with  the  observed  structure.  This  high  cor¬ 
relation  is  from  the  heuristic  of  the  extraction.  When  we  extract  the  information  sharing  links,  we 
just  trim  the  existing  links,  not  add  ones.  However,  the  high  correlation  also  tells  us  that  there 
were  not  many  trimmed  links,  which  implies  that  the  observed  social  links  served  well  as  infor¬ 
mation  diffusion  paths.  The  low  correlation  between  the  result  sharing  structure  and  the  meta¬ 
network  is  coming  from  many  additions  of  links.  This  means  that  the  network  does  not  adequate¬ 
ly  support  informing  the  result  of  the  prerequisite  tasks  to  the  individuals  doing  subsequent  tasks. 

Table  5-2  QAP  correlation  and  other  distance  metrics  between  the  observed  structure  and  the  ex¬ 
tracted  decision  making  structures.  (IS=Information  Sharing,  RS=ResuIt  Sharing,  CI=Command 
Interpretation) 


Cl 

IS 

RS 

Correlation 

0.243 

0.726 

0.004 

Significance 

0.000 

0.000 

0.570 

Hamming  Dis¬ 
tance 

41.000 

30.000 

107.000 

Euclidean  Dis¬ 
tance 

6.403 

5.477 

10.344 

The  MRQAP  analysis  in  Table  5-3.  between  the  extracted  structures  as  independent  variables  and 
the  meta-network  as  a  dependent  variable,  results  in  a  high  R-squared  value,  0.545.  This  is  a  very 
high  value  considering  the  R-squared  is  usually  very  low  in  MRQAP  analyses.  As  the  previous 
correlation  indicates,  the  information  sharing  structure  was  the  biggest  contributor  in  estimating 
the  link  existence  in  the  meta-  network.  The  levels  of  standard  coefficients  of  the  command  inter¬ 
pretation  and  the  result  sharing  structures  are  similar.  However,  the  result  sharing  structure  was 
more  significant  than  the  command  interpretation  while  the  information  sharing  was  far  more 
significant  than  the  other  two.  From  this  MRQAP  result,  we  can  see  that  the  observed  meta¬ 
network  can  be  explained  by  the  decision  making  structures  and  it  embeds  those  structures.  How¬ 
ever,  the  result  sharing  and  the  command  interpretation  are  not  as  well  represented  as  the  infor¬ 
mation  sharing. 

Table  5-3  regression  results.  The  dependent  network  is  the  observed  meta-network,  and  the  indepen¬ 
dent  networks  are  the  extracted  meta-network.  (R-Squared  =  0.  545) 

Variable  Coef  Std.Coef  Sig.Y-  Sig.Dekker 
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Penn 

Constant 

0.015 

0.000 

Cl 

0.440 

0.124 

0.050 

0.000 

IS 

0.582 

0.710 

0.000 

0.000 

RS 

-0.055 

-0.071 

0.110 

0.000 

5.3.3.  Personnel  with  different  levels  of  importance  in  structures 


Table  5-4 


shows  the  top  three  individuals  in  the  four  structures  (observed  meta-network,  informa¬ 
tion  sharing,  result  sharing,  and  command  interpretation)  and  by  using  five  metrics  (degree  cen¬ 
trality,  betweenness  centrality,  eigenvector  centrality,  cognitive  demand,  and  communication).  In 
overall,  Wadih  el-Hage,  Al  Owali  and  Fazul  Abdullah  Mohammed  appear  frequently  in  the  top  3 
critical  agent  lists.  Fazul  Abdullah  Mohammed  seems  to  be  the  most  critical  agent  from  the  cogni¬ 
tive  demand  and  the  communication  perspective.  He  is  the  top  rank  agent  by  every  metric  from 
the  result  sharing  structure.  Also,  Wadih  el-Flage  shows  different  important  level  across  the  origi¬ 
nal  and  information  sharing  structures.  From  the  betweenness  centrality,  he  is  the  second  most 
critical  agent  in  the  original  structure,  but  his  importance  is  ranked  at  the  third  when  we  consider 
the  information  sharing  structure.  In  contrast,  Osama  Bin  Laden  has  the  third  highest  betweenness 
centrality  in  the  result  sharing  structure,  but  his  betweenness  centrality  becomes  the  second  high¬ 
est  when  we  consider  the  result  sharing  structure.  These  different  key  actors  from  different  struc¬ 
tures  suggest  that  key  actors  in  the  observed  structure  might  not  be  the  key  actors  in  the  actual 
decision  making  structures. 


Table  5-4  Top  three  individuals  from  five  metrics  and  four  structures  (OBS=observed  meta-network, 
IS=Information  Sharing,  RS=Result  Sharing,  CI=Command  Interpretation) 


Measure 

Struc¬ 

ture 

Rank  1 

Rank  2 

Rank  3 

OBS 

Khalfan  Khamis 

Ahmed  Khalfan 

Mohamed 

Ghalilani 

Wadih  el-Hage 

Total  Degree 
Centrality 

IS 

Wadih  el-Hage 

Al  Owali 

Osama  Bin  Laden 

RS 

Abdullah  Ahmed 

Abdullah 

Anas  al-Liby 

Al  Owali 

Cl 

Fazul  Abdullah  Mo¬ 

Abdullah  Ahmed 

Khalfan  Khamis 

hammed 

Abdullah 

Mohamed 

OBS 

Al  Owali 

Wadih  el-Hage 

Osama  Bin  Laden 

IS 

Khalfan  Khamis 

Betweenness 

Al  Owali 

Mohamed 

Wadih  el-Hage 

Centrality 

RS 

Abdel  Rahman 

Osama  Bin  Laden 

Mohammed  Odeh 

Cl 

Fazul  Abdullah  Mo¬ 

Abdullah  Ahmed 

Muhammed  Atef 

hammed 

Abdullah 

Eigenvector  Cen- 

OBS 

Wadih  el-Hage 

Al  Owali 

Abdullah  Ahmed 
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Measure 

Struc¬ 

ture 

Rank  1 

Rank  2 

Rank  3 

trality 

Abdullah 

IS 

Abdullah  Ahmed 

Wadih  el-Hage 

A1  Owaii 

Abdullah 

RS 

Fazul  Abdullah  Mo¬ 

Abdullah  Ahmed 

A1  Owaii 

hammed 

Abdullah 

Cl 

Abdullah  Ahmed 

Abdullah 

Ahmed  the  German 

Muhammed  Atef 

OBS 

Fazul  Abdullah  Mo¬ 

Khalfan  Khamis 

hammed 

Mohamed 

A1  Owaii 

IS 

Fazul  Abdullah  Mo¬ 

Khalfan  Khamis 

Cognitive  De¬ 

hammed 

A1  Owaii 

Mohamed 

mand 

RS 

Fazul  Abdullah  Mo¬ 

Abdullah  Ahmed 

hammed 

Abdel  Rahman 

Abdullah 

Cl 

Fazul  Abdullah  Mo¬ 

Khalfan  Khamis 

Mustafa  Mohamed 

hammed 

Mohamed 

Fadhil 

OBS 

Fazul  Abdullah  Mo¬ 

Khalfan  Khamis 

Mustafa  Mohamed 

hammed 

Mohamed 

Fadhil 

IS 

Fazul  Abdullah  Mo¬ 

Khalfan  Khamis 

Mustafa  Mohamed 

Communication 

hammed 

Mohamed 

Fadhil 

RS 

Fazul  Abdullah  Mo¬ 

Khalfan  Khamis 

Mustafa  Mohamed 

hammed 

Mohamed 

Fadhil 

Cl 

Fazul  Abdullah  Mo¬ 

Khalfan  Khamis 

Mustafa  Mohamed 

hammed 

Mohamed 

Fadhil 

Figure  5-11 


shows  that  the  difference  of  metric  evaluation  results  across  the  observed  meta- 


network  and  decision  making  structures.  Specifically,  we  subtract  a  metric  value  of  a  meta¬ 
network  from  the  value  of  a  decision  making  structure.  Overall,  the  differences  of  the  metrics  are 
big,  which  indicates  the  inference  estimated  the  levels  of  individuals’  importance  quite  differently. 
However,  the  difference  in  Communication  and  Eigenvector  Centrality  from  the  observed  net¬ 
work  and  decision  making  structures  are  quite  similar  except  for  a  few  individuals. 


Eigenvector  centrality  and  Communication  are  the  two  metrics  that  show  not  much  difference 
from  the  original  metrics  compared  to  the  extracted  structures.  On  the  other  hand,  Degree,  Bet¬ 
weenness  Centralities  and  Cognitive  Demand  show  differences  between  the  original  and  the  ex¬ 
tracted  structures  across  the  most  of  the  agents. 

Compared  to  the  original  structure,  Anas  al-Liby  (A12)  has  the  higher  degree  centrality  and  the 
higher  cognitive  demand  in  the  result  sharing  structure.  This  suggest  that  he  is  underestimated  in 
the  observed  structure  regarding  the  result  sharing  activity  and  considering  the  degree  centrality 
and  the  cognitive  demand.  In  the  information  sharing  structure,  Wadih  ei-Hage  (A1 1)  and  A I 
Owaii  (A13)  are  important.  They  have  higher  Degree  Centrality  in  the  information  sharing  struc- 
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ture.  Finally,  A/  Owali’S (A\3)  importance  is  over-estimated  from  the  passing  command  interpre¬ 
tations.  His  betweenness  centrality  becomes  lower  when  we  apply  the  metric  to  the  extracted 
Command  Interpretation  structure. 


Figure  5-11  Charts  displaying  the  difference  of  metrics  between  a  meta-network  and  extracted  struc¬ 
tures 
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Table  5-5  l.D.  assignments  to  individuals.  I.D.s  will  be  used  to  distinguish  individuals  in  the  later 
tables.  We  used  some  abbreviations  for  names 


ID 

AO 

A1 

A2 

A3 

A4 

A5 

A6 

Name 

Mu- 

hammed 

Atef 

Fazul  Ab¬ 
dullah  Mo¬ 
hammed 

Abdullah 

Ahmed 

Abdullah 

Khalfan 

Khamis 

Mohamed 

Ahmed 

the 

German 

Ahmed 

Khalfan 

Ghalilani 

Sheik 

Ahmed 

Salim 

Swedan 

ID 

A7 

A8 

A9 

A10 

All 

A12 

A13 

Name 

Fahid 

Mo¬ 

hammed 

Ally 

Msalam 

Azzam 

Mustafa 

Mohamed 

Fadhil 

Osama 

Bin  Laden 

Wadih 

el-Hage 

Anas  al- 
Liby 

A1  Owali 

ID 

A14 

A15 

A16 

A17 

Name 

Ali  Mo¬ 
hammed 

Khlid  A1 
Fawaz 

Mo¬ 

hammed 

Odeh 

Abdel  Rahman 

5.3.4.  Personnel  clusters  with  similar  characteristics 


Since  we  have  four  structures  and  five  metrics  for  each  structure,  we  cannot  visualize  or  cluster 
the  individuals  without  dimensionality  reduction.  Therefore,  we  use  principal  component  analysis 
(PCA)  to  project  the  individuals  in  two  dimensions  with  highest  variances.  I 


Table  5-6 


shows  the 


coefficients  to  generate  the  two  components  corresponding  to  the  two  dimensions,  and  Figure 


5-12 


is  the  projection  of  the  individuals  on  a  two  dimensional  scatter  plot.  The  clusters  in  the 


plots  are  member  profiles  according  to  the  criticality.  For  instance,  there  may  be  a  group  of 
people  with  high  betweenness  and  low  degree  centrality,  and  PCA  will  put  those  individuals  close 
to  each  other.  We  apply  this  analysis  to  the  two  structure  sets:  the  observed  network  and  the  col¬ 
lection  of  the  three  inferred  structures.  Thus,  we  can  distinguish  the  different  member  profiles 
coming  from  the  observed  dataset  and  the  inferred  dataset. 


According  to 


Table  5-6 


we  have  four  sets  of  coefficients:  two  principal  components  for  the  ob¬ 


served  and  the  inferred.  In  the  observed,  the  high  first  principal  component  value  means  high  de¬ 
mand  in  communication  to  complete  the  assigned  tasks  because  it  has  high  coefficient  in  commu¬ 
nication  and  cognitive  demand.  The  high  second  principal  component  value  implies  having  more 
connections  to  Other  personnel  because  it  has  high  coefficients  in  degree  centrality,  eigenvector 
centrality  and  cognitive  demand.  In  the  inferred  structures,  the  meaning  of  the  first  principal 
component,  high  demand  in  communication  to  complete  the  assigned  tasks,  is  similar  to  the 
second  principal  component  of  the  observed,  and  that  of  the  second  component,  having  fewer 
connections  to  personnel '  is  similar  to  the  opposite  of  the  first  component  in  the  observed. 
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Table  5-6  Coefficients  of  two  principal  components  from  the  observed  structure  (top)  and  the  ex¬ 
tracted  structures  (bottom) 


Structure  Prin.  Comp.  1  Prin.  Comp.  2 

Total  Degree  Centrality 

OBS 

0.031 

0.361 

Betweenness  Centrality 

OBS 

0.008 

0.052 

Eigenvector  Centrality 

OBS 

0.105 

0.667 

Cognitive  Demand 

OBS 

0.279 

0.595 

Communication 

OBS 

0.954 

-0.260 

Structure  Prin.  Comp.  1  Prin.  Comp.  2 

IS 

0.041 

0.000 

Total  Degree  Centrality 

RS 

0.045 

-0.073 

Cl 

0.002 

-0.012 

IS 

0.007 

-0.002 

Betweenness  Centrality 

RS 

0.001 

0.000 

Cl 

0.000 

0.000 

IS 

0.057 

-0.028 

Eigenvector  Centrality 

RS 

0.049 

-0.042 

Cl 

-0.090 

-0.988 

IS 

0.159 

-0.043 

Cognitive  Demand 

RS 

0.149 

-0.075 

Cl 

0.142 

-0.047 

IS 

0.525 

-0.065 

Communication 

RS 

0.571 

0.007 

Cl 

0.560 

-0.048 

Figure  5-12  displays  the  clusters  of  individuals  in  the  projection  of  the  two  principal  components 


of  the  two  structures.  The  observed  structure  suggests  four  member  profiles:  many  connections  to 
personnel  and  less  communication  demand  to  complete  their  tasks  (A6);  medium  or  fewer  con¬ 
nections  to  personnel  and  medium  communication  demand  {AO,  A4,  A7,  A8,  A12,  A14,  A15); 
medium  connections  to  personnel  and  high  communication  demand  (A\,  A3,  A5,  A9,  A10,  A13, 
A16,  A17);  many  connections  to  personnel  and  medium  communication  demand  (A2,  A1 1). 


The  inferred  structures  provide  four  profiles:  few  connections  to  personnel  and  less  communica¬ 
tion  demand  to  complete  their  tasks  (A6);  many  connections  to  personnel  and  medium  communi¬ 
cation  demand  (A2,  A4);  fewer  connections  to  personnel  and  medium  communication  demand 
(AO,  A5,  A7,  A8,  A1 1 ,  A12,  A14,  A1 5);  and  fewer  connections  to  personnel  and  high  communi¬ 
cation  demand  (A\,  A3,  A13,  A16,  A17,  A9,  A10). 


These  profiles  tell  the  groups  of  individuals  well  supported  in  communication  to  complete  their 
tasks  and  the  groups,  which  are  not.  Also,  it  specifies  the  groups  communicating  frequently  with 
other  parts  of  the  organizations  and  groups  not  communicating  that  frequently.  For  example,  Fa- 
hid  Mohammed  Ally  M sal  am  (Al)  and  Azzam  (A8)  are  grouped  in  the  same  cluster  in  both  struc- 
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tures.  In  the  observed  structure,  their  profile  indicates  that  they  do  not  have  many  links  to  other 
personnel,  but  they  have  medium  communication  demand  to  complete  their  tasks.  The  extracted 
structure  shows  the  same  profile  for  the  two  terrorists. 


A14 


-0.4  -0.3  -0.2  -0.1 

Principal  Component  2 


0.1  0.2 


£■  -0.2 
£ 


-0.8  -0.6  -0.4  -0.2 

Principal  Component  2 


0.2  0.4 


Figure  5-12  Two  projections  of  metrics  of  individuals  using  two  principal  components.  The  left  is 
using  only  the  observed  structure,  and  the  right  is  from  only  the  extracted  structures. 


5.4.  Conclusion 


This  chapter  demonstrates  what  can  be  achieved  by  integrating  social  network  analysis  and  an 
approach  for  analyzing  the  information  processing  and  decision  making  structure  of  an  organiza¬ 
tion.  Social  network  analysis  has  been  a  prominent  tool  in  investigating  the  structure  of  observed 
networks.  However,  it  may  mis-estimate  the  role  of  individuals  vis-a-vis  specific  tasks,  if  it  is 
applied  only  to  the  observed  network  particularly  where  the  observed  network  crosses  time  pe¬ 
riods  and  tasks.  Information  processing  and  decision  making  structure  analysis  provides  guid¬ 
ance  on  the  fragility  and  robustness  of  the  operational  structure;  but  requires  massive  amount  of 
subject  matter  expertise  and  time  to  estimate.  By  inferring  the  decision  making  structure  from  the 
observed  social  network,  I  am  able  to  focus  the  analysts  or  researchers  attention  on  just  those 
parts  of  the  network  critical  for  the  tasks  of  concern.  I  reduce  time  and  effort  to  construct  the  de¬ 
cision  making  structure  and  so  enable  the  power  of  decision  making  structure  analysis  to  be  used 
on  a  wider  range  of  problems. 


L  imitation:  I  used  inference  heuristics,  so  I  can  extract  a  decision  making  structure.  These  heuris¬ 
tics  are  well-informed  and  frequently  used  by  human  analysts,  and  these  heuristics  are  supported 
by  the  ontology  and  semantics  of  the  meta  network  concept.  However,  this  is  the  introduction  of 
biases.  Without  any  validation  method,  introducing  more  biases  may  lead  analysts  into  a  false 
result. 
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Another  limitation  is  in  the  result  interpretation.  1  come  up  with  a  conclusion  that  there  is  no  sig¬ 
nificant  correlation  between  the  observed  organizational  structure  and  the  result  sharing  inferred 
structure.  However,  given  that  the  data  source  is  a  university  research  report  about  the  US  embas¬ 
sy  bombings,  this  conclusion  may  be  induced  by  the  data  collection  biases.  For  example,  the  data 
collection  activities  are  more  focused  on  the  infonnation  sharing  than  the  reporting  back.  Another 
possibility  is  that  the  adversaries  are  more  adept  in  hiding  result  sharing  compared  to  the  informa¬ 
tion  sharing.  Both  possibilities  can  produce  a  biased  input  observation,  eventually  a  biased  in¬ 
ferred  result  sharing  or  information  sharing  structure.  Therefore,  a  human  analyst  using  this  tool 
should  keep  in  mind  that  the  inference  is  based  on  the  observations,  so  the  biases  in  the  observa¬ 
tions  can  influence  the  inference  result.  This  limitation  is  difficult  to  be  resolved  with  the  given 
data.  Rather,  this  analysis  will  provide  an  opportunity  to  check  the  data  observation  procedure,  so 
that  less  biased  data  can  be  collected  and  data  collections  are  done  across  various  interaction  in¬ 
tentions. 


Theoretic  contribution:  A  by-product  of  this  approach  is  that  each  of  the  components  of  the  deci¬ 
sion  making  structure  are  inferred  including  the  infonnation,  reporting  and  command  structures. 
This  thesis  provides  a  new  way  to  view  flat  social  networks.  So  far,  social  network  analysts  re¬ 
garded  an  observed  social  network  as  is,  and  there  is  no  computational  tool  to  infer  an  embedded 
structure  from  the  flat  observed  network.  However,  since  we  expanded  the  observation  areas  to 
the  resources,  expertise,  and  tasks,  we  can  infer  the  nature  of  the  interactions  based  on  the  addi¬ 
tional  information.  This  meta-network  level  observation  and  the  embedded  structure  inference 
tool  enables  a  new  way  to  handle  a  flat  social  network  as  a  multi-plex  social  network. 


Technical  contribution:  Our  application  results  indicate  that  the  point  of  investigation  into  the 
original  structure  can  be  reduced  by  limiting  the  number  of  terrorists  involved  in  a  specific  sub¬ 
task  network  (the  number  of  agents  are  reduced  from  18  terrorists  to  16  terrorists).  Also,  an  ana¬ 
lyst  can  say  whether  an  organization  is  well-supported  or  not  by  looking  into  the  extracted  task- 
related  networks,  such  as  the  infonnation  sharing  and  the  result  sharing  structures.  These  inferred 
structures  suggest  different  key  personnel  compared  to  the  original  structures.  The  combination  of 
such  key  personnel  may  reveal  hidden  critical  task  executors  or  execution  coordinators.  1  used  the 
principal  component  analysis  (PCA)  to  show  these  profiles  by  using  the  two  structures:  the  origi¬ 
nal  and  the  inferred  structures. 


Empirical  contribution:  This  particular  application  results  found  that  some  key  actors  who  might 
be  over-  or  under-estimated  before8.  For  example,  Anas  ai-Liby  was  the  task  coordinator  who  has 
higher  betweenness  and  degree  centralities  in  the  result  sharing  g  structure  than  in  the  original 
structure.  Also,  this  approach  enabled  different  actor  profiling  by  using  two  different  structures: 
the  original  structure  and  the  extracted  structure.  As  an  example  of  the  actor  profiling  result.  Fa- 
hid  Mohammed  Ally  M sal  am  and  Azzam  are  in  the  same  profile  suggesting  that  they  are  less 
linked  to  other  personnel  and  medium  communication  demand  to  carry  out  their  assigned  tasks. 

8 1  do  not  want  this  remark  to  be  too  definitive  statement  given  that  the  dataset  is  a  nuanced  dataset,  not  a 
completely  verified  dataset.  Also,  the  analysis  result  is  not  fully  verified  and  validated.  1  want  to  note  that 
this  is  just  a  possibility  of  the  over-  or  under-estimations,  not  a  definite  claim. 
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•  Inferred  structure  suggests  new  information  such  as  a  different  list  of  critical  actors  in 
a  networked  structure. 

•  inferred  structure  suggests  more  in-depth  agent  profiles  when  it  is  used  with  the  origi¬ 
nal  structure. 

•  inferred  structure  limits  the  size  of  organizations  of  interests,  so  a  human  analyst  can 
focus  on  the  critical  parts  related  to  a  key  task  execution. 

I  provide  a  technical  method  to  extract  three  decision  making  structures  from  an  observed  social 
network.  This  technical  implementation  is  from  the  theoretical  fusion  between  the  decision  mak¬ 
ing  structure  concept  from  management,  operations  research  and  social  network  analysis  from 
sociology.  Furthermore,  by  providing  different  types  of  links  among  the  same  entities,  the  dynam¬ 
ic  network  analysis  theory  can  enjoy  better  multi-plex  network  datasets. 
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6.  Building  Macro-level  Destabilization  Strategies  -  Influence  Network  Analysis 


Whether  a  task  will  be  completed  or  not  is  one  of  managers’  critical  questions  (Scenario  2  and  3 
in  Ch.  1.2.).  The  managers  estimate  the  chance  of  task  completion  and  support  their  group  to  in¬ 
crease  the  chance.  Traditionally,  they  used  their  past  experience,  hierarchical  structure,  or  authori¬ 
ty  to  facilitate  the  completion.  However,  recent  organizational  trends,  i.e.  fast  changes,  decentra¬ 
lized  structures,  flat  team  models,  etc,  demand  more  than  the  old  enablers.  Thus,  we  need  a  new 
approach  for  the  analysis  of  task  completion  of  an  organization.  The  approach  should  be  robust 
against  a  quickly  changing  operational  environment  and  complex  structures.  Additionally,  it 
should  be  flexible,  so  that  mangers  can  apply  their  subject  knowledge  and  experience  to  the  anal¬ 
ysis.  Thus,  this  paper  introduces  such  an  analysis  approach  that  assesses  an  organizational  struc¬ 
ture  and  estimates  its  task  completion  likelihood. 


An  organizational  structure  contains  factors  that  are  critical  for  its  task  success  (Malone  and 
Smith,  1988).  While  traditional  structures  only  display  the  personnel  formation  and  assignment 
(Hage  et  al.,  1971),  they  are  not  the  only  component  of  organizational  structure.  An  alternative 
view  (Galbraith,  1973;  Thompson,  1967)  is  that  structures  includes  social  networks  as  well  as  the 
personnel  assignment  to  tasks,  the  resource  and  information  availability,  the  task  dependency 
network,  etc.  This  distribution  and  assignment  information  suggests  how  well  a  task  is  supported 
organizationally.  1  use  a  meta-network  format  (Krackhardt  and  Carley,  1998)  to  represent  this 
organizational  structure.  The  meta-network  is  a  multi-modal  and  multi-plex  social  network  in¬ 
cluding  various  elements,  such  as  people,  expertise,  resources  and  tasks;  and  various  relations,  e.g. 
work  relationships,  resource  distribution,  task  assignments.  1  represent  an  organizational  structure 
with  this  format  and  assess  the  support  to  the  task  completion. 


1  utilize  an  influence  network  to  evaluate  the  task  completion  likelihood.  An  influence  network  is 
a  simplification  of  a  Bayesian  network.  It  contains  nodes  representing  events  and  links  encoding 
causal  relationships  among  events.  It  propagates  the  likelihood  of  each  event  through  promotion 
or  inhibition  by  its  parents.  In  the  real  world,  the  influence  network  is  becoming  popular,  as 
knowing  how  to  influence  and  redirect  the  change  of  situation  is  very  important.  For  example, 
influence  network  analysis  has  been  used  to  analyze  the  IED  attacks  over  a  region  of  Iraq  (Wa- 
genhals  and  Levis,  2007).  This  influence  network  contains  belief  statements  related  to  politic, 
military,  social,  economic,  information  and  infrastructure,  so  called  PMESII  (DARPA,  2005; 
Snyder  and  Tolk,  2006)  in  military  planning.  The  network  helps  evaluate  which  sectors  friendly 
forces  should  act  upon  to  lower  the  IED  attack  frequencies  in  the  region 


I  combine  these  two  existing  tools,  the  meta-network  and  the  influence  network,  and  provide  task 
completion  likelihood  estimations  for  various  organizations,  e.g.  grass-roots  organizations,  open 
source  software  development  teams,  corporations,  terrorist  networks,  military  units,  etc  (see  Sce¬ 
narios  in  Ch.  1.2.).  From  previous  organizational  management  literatures,  I  identify  six  important 
factors  in  task  completion.  Then,  I  assess  the  factors  with  an  organizational  structure  in  a  meta- 
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network.  Then,  the  assessments  on  factors  become  nodes  in  the  influence  networks,  and  I  build  up 
the  causal  links  by  utilizing  a  task  dependency  network.  The  nodes  of  assessments  and  links  of 
task  dependencies  make  up  an  influence  network  that  we  finally  use  to  estimate  the  task  comple¬ 
tion  likelihood.  In  this  paper,  we  use  the  above  influence  network  generation  idea  and  implement 
a  function  to  carry  it  out.  I  test  the  implemented  idea  with  a  terrorism  act,  the  1998  US  Embassy 
bombing  in  Tanzania  and  Kenya  (see  the  introduced  dataset  in  Ch.  4.2).  My  approach  is  able  to 
identify  the  tasks  that  are  well-  or  ill-supported  by  the  terrorist  network,  and  to  find  the  critical 
tasks  that  if  prevented  will  have  a  significant  impact  on  the  probability  of  overall  mission  comple¬ 
tion  based  on  the  key  task  dependency  path. 

6.1.  Background  about  the  Integration  of  the  Dynamic  Network  and  the  Influ¬ 
ence  Network  Analyses 


I  build  a  Bayesian  network  model  (an  influence  network)  from  a  meta-network.  This  Bayesian 
network  assess  the  task  completion  probability  by  assessing  six  factors  in  the  task  completion 
from  the  Operations  Research,  Management  viewpoints.  The  used  Meta-Network  concept  is  al¬ 
ready  introduced  in  Ch.  4.1.  I  outlines  the  basic  of  the  influence  network  and  the  six  assessment 
points  over  the  course  of  the  influence  network  generation. 

6.1.1.  Influence  network  used  in  the  real  world 

Influence  network  (Rosen  and  Smith,  1996;  Wagenhals  et  al.  1998)  is  a  semi-Bayesian  network 
including  belief  statement  nodes  and  influencing  or  causal  links  among  the  statement  nodes.  It 
uses  a  simplified  knowledge  elicitation  mechanism  that  heuristically  generates  a  conditional 
probability  table  for  each  belief  statement  node  that  has  influencing  parents,  and  it  computes  the 
marginal  probabilities  of  the  nodes  with  parents  given  the  probability  of  each  of  the  bottom  nodes. 
Originally  developed  to  support  the  assessment  of  political-social  influence  strategies,  their  use  is 
most  appropriate  for  modeling  situations  in  which  it  is  difficult  to  specify  conditional  probability 
values  especially  if  their  values  are  subjective  and  they  cannot  be  estimated  by  empirical  evidence. 
Applications  include  military  planning  at  the  operational  and  strategic  level  and  counterterrorism. 
For  instance,  Wagenhals  and  Levis  (2007)  designed  an  influence  network  focused  on  subduing 
IED  attacks  in  Iraq.  Hudson  et  al  (2001)  introduces  potential  usages  for  counterterrorism,  and 
Rosen  and  Smith  ( 1 996)  show  an  influence  network  model  for  building  a  military  and  diplomatic 
strategy. 


Traditionally,  influence  networks  have  been  produced  by  subject  matter  experts.  They  have 
knowledge  of  the  target  situation  and  organization,  assess  belief  statements  related  to  a  target 
event  or  effect,  and  create  an  influence  network  by  setting  up  its  nodes,  links  and  parameters 
based  on  their  own  knowledge.  However,  this  creates  a  number  of  problems  in  real  usages  of  this 
inference  tool  (Vego,  2006).  First,  model  generation  takes  a  long  time.  Second,  the  generation  is 
based  on  experts’  opinions  and  there  may  be  disagreements  and  inaccuracies.  Currently,  experts 
decide  on  what  the  related  belief  statements  are,  how  the  topology  shapes  the  linkage  of  beliefs, 
what  the  baseline  probability  of  the  each  belief  should  be,  etc.  However,  without  a  template  or  a 
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commonly  accepted  practice  of  network  generation,  the  influence  network  created  can  be  biased 
by  an  individual  analyst’s  point  of  view.  Therefore,  a  potential  solution  is  a  tool  that  creates  a 
blueprint  of  an  influence  network  with  a  standardized  template  that  experts  can  examine  and  cus¬ 
tomize  based  on  their  expertise. 

6.1.2.  T raditional  management  methodologies  for  task  completion  and  found  criti¬ 
cal  factors 

Traditionally,  organizational  performance  management  has  been  based  on  qualitative  analysis  and 
case  studies.  The  management  community  focused  on  developing  a  metric  for  organizational  per¬ 
formance  (Dess  and  Robinson,  1984),  but  there  are  no  outstanding  metrics  that  researchers  fre¬ 
quently  utilize.  Only  some  particular  fields  have  several  suggested  metrics,  e.g.  shared  situation 
awareness  in  military  command  and  control  structure  analysis  (Graham,  2005).  However,  man¬ 
agement  researchers  have  been  able  to  identify  cases  of  good  group  performance  based  on  qualit¬ 
ative  assessments  and  have  found  reasons  for  successes.  For  instance,  group  efficacy  (Silver  and 
Bufanio,  1996)  is  a  critical  factor  in  organizational  performance.  When  group  members  believe 
that  they  can  accomplish  the  mission,  then  they  really  complete  the  mission.  In  deeper  sense,  they 
may  be  intuitively  gauging  their  ability  to  perfonn  the  task,  assessing  the  situation,  and  perceiving 
that  they  can  do  the  job.  Also,  work  attitudes  and  satisfaction  (Ostroff,  1992)  are  positively  corre¬ 
lated  with  group  perfonnance.  In  other  words,  happy  workers  work  better.  Whereas  these  qualita¬ 
tive  assessments  on  the  group  or  individual  mental  state  are  important  in  understanding  the  group 
perfonnance,  these  are  not  tangible  or  easily  assessable  factors,  or  they  are  too  obvious  to  apply 
to  the  real  complex  organizational  management. 


On  the  other  side  of  aisle,  researchers  have  identified  factors  derived  from  the  nature  of  tasks  or 
organizational  structure.  For  example,  the  operations  research  domain  has  developed  task  prece¬ 
dence  network  analysis  (Eisner,  1962).  It  suggests  better  ways  to  organize  the  task  perfonnance 
plan  or  to  minimize  the  impact  of  completion  delays,  etc.  While  the  task  dependency  is  one  factor 
considering  the  links  among  the  tasks,  the  task  complexity  and  the  importance  of  each  task  are 
other  factors  that  affect  tasks  completion  (Campbell,  1991;  Forsyth  and  Schlenker,  1977).  Orga¬ 
nizational  structure  suggests  the  criticality  of  personnel,  resources  and  infonnation  distribution. 
Human  resource  management  is  another  approach  to  enhance  the  organizational  performance  by 
assigning  personnel  to  tasks  effectively  (Becker  and  Gerhart,  1996).  Furthermore,  as  organiza¬ 
tions  perform  knowledge-intensive  tasks,  the  diffusion  of  knowledge  or  knowledge  management 
becomes  another  important  factor  in  getting  a  job  done  (Argote  and  Ingram,  2000). 


Our  objective  for  this  paper  is  to  describe  a  tool  that  assesses  the  organizational  structure  and  sit¬ 
uations  and  estimates  the  task  completion  likelihood.  Since  our  approach  is  based  on  the  current 
meta-network  framework,  it  does  not  have  enough  information  to  evaluate  the  psychological  as¬ 
pects  of  the  workers  and  the  group.  However,  we  use  the  factors  from  the  task  natures  and  the 
organizational  structure  since  they  are  represented  in  the  meta-network  format.  We  build  heuris¬ 
tics  assessing  the  above  factors  with  a  meta-network  and  use  the  assessment  to  generate  an  influ¬ 
ence  network,  or  a  tool  for  estimating  task  completion  likelihood.  Sensitivity  analysis  over  the 
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heuristic  parameters  can  provide  insight  into  potential  task  vulnerabilities  indicating  potential 
points  of  influence,  which  can  support  the  point  of  view  of  task  management  or  task  or  mission 
intervention. 

6.2.  Method  -  Generating  an  influence  network  from  a  meta-network 

1  generate  an  influence  network  explaining  the  likelihood  of  a  task  completion  from  a  meta-  net¬ 
work.  Thus,  inputs  for  the  generation  are  1 )  a  meta-  network,  2)  a  target  task  to  be  analyzed  in  the 
network  and  3)  parameters  for  the  generated  influence  network.  Political,  Military,  Economic, 
Social,  Information  and  Infrastructure,  or  PMESII,  aspects  are  the  elements  of  assessing  a  situa¬ 
tion  in  traditional  influence  network  building.  For  the  task  completion  assessment,  I  similarly 
identify  six  factors  contributing  to  a  task  completion,  and  these  six  factors  come  from  the  litera¬ 
ture  review  of  the  previous  section.  The  six  factors  are  1)  prior  task  completion,  2)  task  impor¬ 
tance,  3)  task  complexity,  4)  personnel  assignment,  5)  accessible  expertise  and  6)  available  re¬ 
sources.  The  below  sections  explain  how  we  extracted  each  of  the  task  completion  factors  and 
turn  them  into  a  node  in  the  influence  network.  After  the  generation  of  an  influence  network,  we 
evaluate  the  propagated  task  completion  likelihood  using  the  CAusal  STrength  (CAST)  algorithm 
developed  by  Rosen  and  Smith  (1996).  The  overall  procedure  of  using  this  method  is  described 
in  Figure  6-1 

r - i 


Figure  6-1  The  procedure  of  influence  network  generation  and  task  completion  likelihood  estimation 
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6.2.1.  Overall  structure  of  a  generated  influence  network 


I  describe  the  overall  structure  and  how  the  accompanying  parameters  are  determined.  The  struc¬ 
ture  of  a  generated  influence  network  is  explained  in  two  steps.  First,  the  skeleton  of  the  influence 
network  is  derived  from  the  task  network  of  a  particular  final  task.  In  the  meta-  network,  there  is  a 
task  network  specifying  the  prior  and  the  next  tasks  of  a  certain  task.  If  an  analyst  selects  a  task  to 
be  analyzed,  I  infer  a  sub-network  that  only  selects  the  tasks  related  to  the  completion  of  the  final 
task  and  create  a  task  network  for  it.  That  becomes  the  skeleton  of  the  influence  network.  After 
that,  we  assess  the  likelihood  of  success  for  each  task  by  adding  the  above  six  factors  as  influence 
network  nodes.  This  becomes  the  flesh  of  influence  network  modeling  the  success  of  the  each 
task.  With  these  two  parts,  I  can  propagate  the  estimation  of  the  success  likelihood  of  individual 
task  throughout  the  influence  network  with  the  skeleton  of  task  network,  Figure  6-2. 


Figure  6-2  A  simple  diagram  displaying  how  a  generated  influence  network  is  structured 

While  we  set  the  topology  of  the  influence  network  as  above,  we  supply  a  set  of  heuristics  for 
determining  the  accompanying  parameters  for  the  network.  These  heuristics  contains  our  assess¬ 
ment  criteria  on  how  to  organize  personnel,  resources  and  expertise  to  successfully  execute  a  task. 

To  use  this  approach,  the  user  will  need  to  provide  a  series  of  marginal  probabilities  for  each  fac¬ 
tor  in  Column  1,  Table  6-1  To  illustrate  this  use,  we  provide  sample  probabilities  in  Column  2 
and  the  rational  we  used  in  choosing  the  probabilities  in  Column  3.  The  use  may  wish  to  use 
probability  values  other  than  those  we  use  in  this  example. 
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Table  6-1  Assignments  of  marginal  probabilities  (or  baseline  probability  for  task  network  nodes)  for 
influence  network  nodes. 


Influence  network 

Node 

Illustrative  Node 
Probability 

Illustrative  rational  and  organizational 
structure  assessment  criteria  for  assigning 
the  illustrative  node  probability 

Task  A  is  done 

(Task  network) 

Medium:0.5 

We  assume  that  if  there  is  no  external  influ¬ 
ence,  the  task  has  50%  chance  of  being  com¬ 
pleted. 

Task  A  is  Complex 
(task  complexity) 

Very  Low:  0,  Low: 
0.25,  Medium:0.5, 
High:  0.7, 

Very  High:  0.8 

We  assume  that  if  1  person  and  0  re¬ 
source/expertise  required,  then  the  task  has 
very  low  complexity. 

We  assume  that  if  2  persons  and  1  re¬ 
sources/expertise  required,  then  the  task  has 
low  complexity. 

We  assume  that  if  3  persons  and  3  re¬ 
sources/expertise  required,  then  the  task  has 
medium  complexity. 

We  assume  that  if  6  persons  and  7  re¬ 
sources/expertise  required,  then  the  task  has 
high  complexity. 

We  assume  that  the  task  has  very  high  com¬ 
plexity  in  the  other  cases 

Task  A  is  important 
(task  importance) 

Very  Low:  0,  Low: 
0.25,  Medium:0.5, 
High:  0.7, 

Very  High:  0.8 

We  assume  that  if  0  degree  or  0  betweenness 
centrality,  then  the  task  has  very  low  impor¬ 
tance. 

We  assume  that  if  0  -  0.25  degree  or  0  -  0.25 
betweenness  centrality,  then  the  task  has  low 
importance. 

We  assume  that  if  0.25  -  0.5  degree  or  0.25  - 
0.5  betweenness  centrality,  then  the  task  has 
medium  importance. 

We  assume  that  if  0.5  -  0.75  degree  or  0.5  - 
0.75  betweenness  centrality,  then  the  task  has 
high  importance. 

We  assume  that  the  task  has  very  high  impor¬ 
tance  for  the  rest  of  cases. 

Task  A  has  sufficient 
assigned  personnel 
(personnel  sufficiency)9 

Very  Low:  0,  Low: 
0.25,  Medium:0.5, 
High:  0.710 

We  assume  that  if  0%  of  required  resources 
and  expertise  are  covered  by  the  assigned  per¬ 
sonnel,  then  the  task  has  very  low  personnel 

9  Over  the  course  of  developing  this  framework,  there  was  an  interesting  discussion  about  measuring  per¬ 
sonnel  sufficiency.  We  measure  personnel  sufficiency  by  counting  the  number  of  assigned  people  with  any 
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Influence  network 

Node 

Illustrative  Node 
Probability 

Illustrative  rational  and  organizational 
structure  assessment  criteria  for  assigning 
the  illustrative  node  probability 

support. 

We  assume  that  if  50%  of  required  resources 
and  expertise  are  covered  by  the  assigned  per¬ 
sonnel,  then  the  task  has  low  personnel  sup¬ 
port. 

We  assume  that  if  75%  of  required  resources 
and  expertise  are  covered  by  the  assigned  per¬ 
sonnel,  then  the  task  has  medium  personnel 
support. 

We  assume  that  if  100%  of  required  resources 
and  expertise  are  covered  by  the  assigned  per¬ 
sonnel,  then  the  task  has  high  personnel  sup¬ 
port. 

Resource  A,  a  required 
resource  of  task  A,  is 
available 

(available  resources) 

Very  Low:  0.25, 

Low:  0.5, 

Medium:0.75, 

We  assume  that  if  the  task  has  0  assigned  per¬ 
sonnel  with  the  required  resource,  then  the 
task  has  very 

We  assume  that  if  the  task  has  1  assigned  per¬ 
sonnel  with  the  required  resource,  then  the 
task  has  low  resource  support. 

We  assume  that  if  the  task  has  2  or  more  as¬ 
signed  personnel  with  the  required  resource, 
then  the  task  has  medium  resource  support. 

Expertise  A,  a  required 
expertise  of  task  A,  is 
(accessible  expertise) 

Very  Low:  0.25, 

Low:  0.5, 

Medium:0.75, 

We  assume  that  if  the  task  has  0  assigned  per¬ 
sonnel  with  the  required  expertise,  then  the 
task  has  very  low  expertise  support 

We  assume  that  if  the  task  has  1  assigned  per¬ 
sonnel  with  the  required  expertise,  then  the 
task  has  low  expertise  support. 

We  assume  that  if  the  task  has  2  or  more  as¬ 
signed  personnel  with  the  required  expertise, 
then  the  task  has  medium  expertise  support. 

of  relevant  resources  or  expertise.  However,  this  implies  that  a  person  with  no  proper  resource  or  expertise 
is  not  capable  of  doing  the  task.  This  is  true  in  the  work  environment  requiring  very  specific  skills  and  re¬ 
sources,  i.e.  surgery.  The  other  way  of  counting  assigned  personnel  is  just  counting  any  assigned  people. 
We  take  the  first  way  since  we  felt  that  our  application  requires  specific  mental,  knowledge,  resource  prep¬ 
arations.  However,  the  users  can  select  either  way  of  measuring  personnel  sufficiency  by  choosing  an  op¬ 
tion  when  they  use  ORA  that  implements  this  framework. 

10  Though  the  organizational  structure  shows  that  the  100%  of  resources  and  expertise  are  covered  by  the 
assigned  people,  some  analysts  may  want  to  assign  not  1.0  probability  for  the  assigned  personnel  because 
some  domains  have  risks  and  uncertainties  in  handling  the  resources  and  expertise  that  are  already  covered. 
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While  Table  6-1  specifies  how  we  determine  the  marginal  or  baseline  probabilities  of  the  influ¬ 
ence  network  nodes,  each  of  the  influence  network  links  requires  two  parameters:  promotion  and 
inhibition  weights.  The  promotion  weight  is  the  strength  of  the  influence  toward  the  destination 
influence  network  node  when  the  start  node  is  true.  The  inhibition  is  the  influence  strength  to  the 
destination  node  when  the  start  node  is  false.  Throughout  this  paper,  1  use  0.5  for  promotion  and  - 
0.5  for  inhibition  weights  (except  for  the  task  complexity  to  task  completion  arc,  which  is  an  in¬ 
hibitor;  for  this  we  use  -0.5  and  0.5,  respectively).  These  values  are  selected  because  we  want  to 
balance  the  causal  strengths  regardless  of  the  success  of  the  parent  nodes.  These  weights  can 
change  as  human  analysts’  qualitative  assessment  of  a  target  situation.  If  human  analysts  feel  that 
the  failure  of  a  task  facilitates  the  failure  of  the  subsequent  tasks  more  than  the  task  success  pro¬ 
motes  the  subsequent  task  successes,  they  should  decrease  the  promotion  weight  and  increase  the 
inhibition  weight. 

6.2.2.  Task  network 

Unlike  the  other  five  factors,  the  effect  of  prior  task  completion  propagates  to  the  child  tasks 
throughout  an  influence  network.  For  instance,  if  task  A  is  a  prior  task  of  task  B,  and  task  B  is 
that  of  task  C,  the  likelihood  of  task  A  affects  that  of  task  C.  This  is  different  from  the  other  fac¬ 
tors,  i.e.  task  complexity  of  a  certain  task  contributes  to  the  task’s  completion  likelihood  in  a  neg¬ 
ative  way,  but  this  contribution  is  limited  to  that  task.  This  propagation  relation  can  be  extracted 
from  the  task  network  in  a  meta-network.  If  the  task  network  has  directionality,  we  can  see  the 
task  flow  from  the  initial,  leaf  task  or  tasks  to  a  certain  task.  For  example,  Figure  6-3  shows  an 
extracted  task  network,  a  task  network  for  detonate  task.  Because  prior  task  completion  is  the  on¬ 
ly  factor  with  a  propagation  characteristic,  we  build  up  an  influence  network  from  this  task  net¬ 
work  for  a  specific  task.  Then,  we  can  add  the  other  five  factors  to  each  of  the  task  in  the  con¬ 
structed  influence  network. 
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6.2.3.  Task  importance 


A  task  is  more  likely  to  be  executed  successfully  if  the  task  is  considered  to  be  important.  There¬ 
fore,  as  the  task  importance  of  a  specific  task  goes  up,  the  task  completion  likelihood  increases 
and  task  importance  has  a  promoting  influence  on  task  completion.  Then,  the  question  is  how  to 
measure  the  importance  of  each  task  in  the  task  network.  I  gauge  the  importance  based  on  the 
number  of  prior  and  following  task  in  the  task  network.  If  a  task  has  many  prior  or  next  tasks,  the 
task  is  important.  This  factor  can  be  measured  by  the  degree  centrality  of  a  task  in  a  task  network. 
Also,  if  a  task  is  on  many  critical  paths  among  two  tasks  in  the  task  network,  the  task  is  important. 
This  is  captured  by  measuring  the  betweenness  centrality  of  a  task.  For  instance,  in  the  task  de¬ 
pendency  network  of  Figure  6-3.  the  get  moneyta.sk  is  a  task  with  0.125  degree  centrality  and 
0.020  betweenness  centrality,  so  the  task  is  considered  to  have  low  importance,  which  assigns 
0.25  marginal  probability  to  the  task  importance  factor.  Each  task  node  in  the  influence  net  has 
the  task  importance  factor  node  as  a  parent  in  the  influence  network,  and  the  importance  node 
probability  is  calculated  from  the  heuristics  as  described  in  the  previous  section. 

6.2.4.  Task  complexity 

A  task  is  less  likely  to  be  performed  if  the  task  has  high  complexity.  In  a  meta-network,  ‘a  task  is 
complex’  means  that  the  task  requires  many  personnel  involvements  and  different  types  of  re¬ 
sources  and  expertise.  Thus,  we  measure  the  task  complexity  factor  with  the  number  of  assigned 
agents  and  the  number  of  required  resources  and  expertise.  For  example,  Figure  6-4  shows  two 
tasks,  overall  planning  and  execution  and  dean  Of  evidence.  The  former  has  six  associated  agent, 
four  required  expertise,  and  two  required  resources.  The  latter  has  two  assigned  agents,  Mustafa 
Mohamed  Fadhit  and  Fazui  Abdullah  Mohamed,  one  required  resources  and  one  required  exper¬ 
tise.  Therefore,  the  overall  planning  and  execution  task  is  complex  than  the  dean  of  evidence  task 
because  the  former  has  more  involved  agents,  resources  and  expertise.  When  I  assign  the  margin¬ 
al  probability,  the  former  has  0.5,  and  the  latter  has  0.25.  This  task  complexity  becomes  a  node  in 
the  influence  network  and  is  linked  to  the  task  node  as  described  in  Ch.  6.2.1. 
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Figure  6-4  (top)  A  sub  meta-network  including  nodes  in  one  social  link  distance  from  overall  planning 
and  execution  task,  (bottom)  A  sub  meta-network  for  the  clean  of  evidence  task 


6.2.5.  Personnel  sufficiency 

A  higher  probability  of  personnel  sufficiency  is  a  key  element  in  the  task  completion.  However, 
we  have  seen  that  only  providing  an  agent  without  any  proper  resources  or  expertise  is  not 
enough.  Therefore,  when  we  count  the  personnel  sufficiency,  we  consider  not  only  the  number  of 
agents,  but  also  whether  the  agent  has  the  required  resources  or  expertise.  For  instance,  as  shown 


in  Figure  6-4.  the  overall  planning  and  execution  task  has  four  covered  expertise  by  assigned 


agents  and  one  acquired  resource  by  Wadih  el- H age.  Thus,  83.3%  of  required  organizational  ele¬ 
ments  are  covered.  According  to  ' 


Table  6-1 


then  the  personnel  sufficiency  of  this  task  has  0.5 


marginal  probability.  Personnel  count  without  considering  whether  or  not  the  assigned  person  has 
any  relevant  resources  or  expertise  is  different  from  counting  just  assigned  persons  regardless  of 
their  possession  of  resources  and  expertise.  We  further  described  our  rationale  in  the  footnote  of 
Chapter  6.2.1. 


6.2.6.  Available  resources 


CMU  SCS  ISR 


-90- 


CASOS  Report 


Providing  required  resources  of  a  task  to  assigned  agents  is  an  important  factor  in  task  completion. 


Considering  the  overall  planning  and  execution  task  in  Figure  6-4.  real  estate  is  provided  to  Wa¬ 


di  h  el- H age,  but  the  meta-network  show  that  the  house  is  assigned  to  no  one  doing  the  task. 
Therefore,  an  influence  network  node,  real  estate  is  available,  has  a  medium  marginal  probability, 
0.5,  compared  to  that  of  house  is  available,  0.25. 


6.2.7.  Accessible  expertise 


Finally,  making  expertise  accessible  through  assigned  personnel  is  critical  in  task  completion. 
The  Review  Surveillance  Files  task, 


Figure  6-5.  has  one  required  expertise,  surveillance  expertise. 


Anas  a l-Liby  has  this  expertise,  and  he  is  also  assigned  to  the  task,  as  well.  However,  the  exper¬ 
tise  is  not  known  to  any  other  assigned  personnel.  This  means  that  Anas  al-Liby  is  the  only  chan¬ 


nel  for  accessing  the  required  expertise.  The  heuristic  in  Table  6-1  assigned  a  0.5  marginal  proba 


bility  for  this  case.  If  the  expertise  had  been  known  to  one  more  assigned  person,  then  the  proba¬ 
bility  could  be  0.75,  but  this  was  not  the  case  in  this  dataset. 


Figure  6-5  A  sub  meta-network  including  nodes  in  one  social  link  distance  from  review  surveillance 
files 


6.2.8.  Difference  among  meta-network,  traditionally  created  influence  network, 
and  automatically  generated  influence  networks 


To  illustrate  an  automatically  generated  influence  network  in  detail,  I  compare  it  to  the  meta¬ 
network  and  the  traditionally  created  influence  network.  Through  the  comparisons,  I  show  what 
should  be  inferred  and  assumed  to  fill  the  gap  between  the  meta-network  and  the  influence  net¬ 


work.  I  organized  the  comparisons  in  Table  6-2 


As  shown  in  Table  6-2 


the  meta-network  and  the  influence  network  have  different  meanings  of 
their  nodes  and  links.  For  instance,  the  nodes  in  a  meta-network  are  entities  while  those  in  an  in¬ 
fluence  network  are  propositions  that  may  be  true  or  false.  Therefore,  I  interpret  the  links  and  the 
entities  in  the  meta-network  and  generate  a  belief  statement  with  the  interpretation.  If  there  is  a 
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task,  or  T,  with  four  assigned  members,  and  if  the  four  members  have  proper  expertise  or  re¬ 
sources,  then  we  generate  a  proposition  “Sufficient  actors  associated  with  T”  with  high  marginal 
probability  (considering  that  T  is  well  supported  with  four  assigned  people).  This  approach  is 
similar  to  the  narrative  network  representation  (Pentland  and  Feldman,  2007)  that  stores  a  story  of 
operations  in  a  network  fonnation. 


Additionally,  nodes  and  links  in  a  meta-network  do  not  have  parameters  except  edge  weights 
showing  the  strength  of  the  link.  However,  an  influence  network  requires  three  parameters:  base¬ 
line  probabilities  for  nodes  with  parents;  and  inhibition  and  promotion  parameters  for  links.  Whe¬ 
reas  traditionally  created  influence  networks  obtain  these  values  from  subject  matter  experts,  in 
the  approach  in  this  paper,  1  supply  these  values  by  utilizing  a  set  of  heuristics  assessing  the  situa¬ 
tion  as  captured  in  the  meta-network  and  assigning  predefined  marginal  probabilities.  For  the  in¬ 
hibition  and  promotion  parameters,  I  use  default  values:  0.5  promotion  and  -0.5  inhibition 
weights  on  the  promoting  arcs  and  the  inverse  on  the  inhibiting  arcs  (from  task  complexity  to  task 
completion). 


Table  6-2  Comparison  among  meta-network,  automatically  generated  influence  network,  and  tradi¬ 
tionally  created  influence  network 


Meta-Network 

Automatically  generated 
influence  network 

Traditionally  created  in¬ 
fluence  network 

Node 

Entities  in  an  organiza¬ 

Belief  statements  in  a  pre¬ 

Belief  statements  from 

tion 

defined  template 

subject  matter  experts 

Link 

Relations  among  enti¬ 

Influence  or  Causal  link 

Influence  or  Causal  link 

ties 

from  one  belief  to  another 

from  one  belief  to  another 

Node  Pa¬ 
rameter 

None 

Predefined  baseline  proba¬ 
bility  of  a  belief  becoming 

Expert’s  baseline  proba¬ 
bility  of  a  belief  becom¬ 

true 

ing  true 

Link  Para¬ 
meter 

Edge  weight  showing 
the  strength  of  the  rela¬ 
tion 

Predefined  promotion  and 
inhibition  parameters 

Expert’s  promotion  and 
inhibition  parameters 

6.3.  Application 


We  learn  more  about  the  task  performance  in  the  Tanzania  and  Kenya  Embassy  Bombing  then  we 
would  from  the  rneta  network  alone  when  we  apply  this  approach.  After  creating  the  influence 
network  using  the  procedures  described  in  Ch.  6.2.,  1  first  use  the  influence  net  to  estimate  the 
task  completion  likelihood  for  each  task.  This  likelihood  depends  on  the  assessments  on  person¬ 
nel  sufficiency,  resources  and  information  availability,  and  task  complexity  and  importance.  By 
ranking  the  tasks  by  task  completion  likelihood,  we  can  identify  the  tasks  that  are  at  risk.  Next, 
we  vary  the  values  of  the  heuristically  derived  parameters  to  see  the  impact  on  the  likelihood  of 
task  completion  and  the  effects  on  the  rankings. 
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6.3.1.  Evaluation  of  task  completion  likelihoods 


Figure  6-6  shows  the  generated  influence  network  analyzing  the  completion  likelihood  of  a  task, 


detonate.  Pythia  (Wagenhals  and  Levis,  2007),  an  influence  network  analysis  program  that  incor¬ 
porates  the  CAST  algorithm  (Rosen  and  Smith,  1996),  was  used  to  create  the  influence  net.  Py¬ 
thia  was  used  to  evaluate  this  influence  network. 


Figure  6-6  The  visualization  of  a  generated  influence  network  for  analyzing  the  completion  likelihood 
of  detonate  in  the  Kenya  case  (see  the  dataset  introduction  in  Ch.  4.3.) 


Figure  6-7 


and 


Table  6-3 


displays  the  evaluation  result  of  the  task  nodes.  We  put  each  task  as  the 


target  task  to  be  analyzed  and  obtained  its  completion  likelihood  from  the  influence  net.  The  node 
sizes  of  Figure  6-7  have  been  adjusted  to  reflect  their  likelihood  as  computed  in  the  influence  net; 
the  larger  the  node,  the  more  likely  the  task  will  be  completed.  Among  the  tasks,  provide  money 
is  the  hardest  task  to  execute  (based  on  the  probability  of  completion).  The  second  hardest  task  is 
conceal  bomb  in  car.  These  two  tasks  are  difficult  because  their  initial  resources  and  information 
distribution  was  not  supportive.  For  example,  provide  money  requires  money,  bank  account  and 
order  from  bin  laden,  but  none  of  these  organizational  elements  were  given  to  assigned  terrorists, 
Khatid  At  Fawaz and  Wadih  et-Hage.  The  same  reason  can  be  applied  to  conceal  bomb  in  car 
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case,  which  has  four  required  organizational  elements  and  none  of  them  are  acquired  by  the  ex¬ 
ecuting  agents. 


education_and_training 

film_videotape_announcing_martyrdom 

clean_of_evidence 

lead_attackets  to  ^mbass' 
detona 

explosion 

leave  bomb  and  car, 


conceal  bomb  in  ca 


brief  attack_team 

final_reconnaissance_mission 

arrange_for_facilitation_and_delivery 
review_surveillance_files 
'plan|iiing_and_execution 

surveillance_of_possible_targets 
driving_trai?Hng 

provide_money 


urchasie_vehicle 
get_money 
u/‘chase_acetylene 
purchaseKpxygen 
preparation  ^rent  residence 
r_bomb_factory 


Figure  6-7  The  visualization  of  the  task  dependency  network.  The  node  sizes  are  adjusted  to  the 
completion  likelihood  of  the  tasks. 

Table  6-3  Task  completion  likelihoods  when  evaluated  with  default  (medium)  threshold  for  assess¬ 
ment  and  default  (medium)  probability  assignment  for  baseline11 


Task  Name 

Completion 

Likelihood 

Task  Name 

Completion 

Likelihood 

overall  planning  and  execution 

0.439 

leave  bomb  and  car 

0.284 

load  bomb 

0.358 

rent  residence 

0.383 

review  surveillance  files 

0.545 

run  bomb  factory 

0.466 

brief  attack  team 

0.317 

purchase  vehicle 

0.448 

final  reconnaissance  mission 

0.304 

purchase  oxygen 

0.448 

lead  attackers  to  embassy 

0.309 

purchase  acetylene 

0.448 

clean  of  evidence 

0.294 

get  money 

0.647 

film  videotape  announcing  mar¬ 
tyrdom 

0.496 

explosion 

0.317 

arrange 

for  facilitation  and  delivery 

0.356 

Surveillance 
of  possible  targets 

0.508 

driving  training 

0.417 

detonate 

0.259 

bomb  preparation 

0.461 

education  and  training 

0.385 

1 1  While  we  display  the  task  completion  likelihood  numbers  in  Table  6-3  J  we  do  not  expect  that  we  can 
estimate  the  likelihood  at  the  precision  level  of  the  numbers.  In  other  words,  we  expect  that  the  likelihood 
of  brief  attack  team  must  be  significantly  higher  than  that  of  final  reconnaissance  mission,  but  we  do  not 
think  that  this  can  happen  with  exactly  2.41 1-times  more  likelihood. 


CMU  SCS  ISR 


-94- 


CASOS  Report 


Task  Name 

Completion 

Likelihood 

Task  Name 

Completion 

Likelihood 

driving 

0.432 

provide  money 

0.231 

conceal  bomb  in  car 

0.234 

6.3.2.  Design  of  computational  experiments  for  various  settings 


I  analyze  the  sensitivity  of  task  completion  likelihoods  by  performing  computational  experiments. 
The  computational  experiments  are  done  by  repeatedly  generating  influence  networks  modeling 


the  same  task,  but  with  different  marginal  probability  parameters  in  Table  6-4]  This  marginal 


probability  differentiation  imitates  human  analysts’  different  viewpoints  toward  the  analysis  sit¬ 
uation.  If  human  analysts  consider  that  the  operational  environment  is  relatively  unfavorable,  the 
probability  parameters  must  be  low,  and  vice  versa.  Therefore,  I  experiment  with  the  sensitivity 
of  my  tool  parameters,  and  the  users  of  this  tool  will  take  the  sensitivity  result  into  account  when 
they  decide  the  parameters. 


1  can  diversify  the  setting  in  two  aspects.  First,  I  can  change  the  parameters  of  the  assessment 
heuristics.  For  instance,  this  framework  will  assign  low  marginal  probability  if  a  task  needs  two 
persons  and  one  resource  or  expertise.  When  I  change  the  parameters  of  assessment,  I  change  the 
two-person  requirement  to  a  three  or  four-person  requirement,  which  means  that  more  personnel 
will  be  required  to  regard  a  task  as  complex  than  before.  Second,  I  can  change  the  marginal  prob¬ 
ability  assignment,  in  default,  1  assign  0.25  as  the  marginal  probability  when  we  consider  the  task 
is  complex  at  the  low  level.  If  we  change  the  probability  assignment,  we  change  the  0.25  value  to 
another  value  between  0  and  1 . 


Table  6-4 


shows  three  levels  of  parameters  for  assessment  heuristics 


Table  6-5 


displays  three  le¬ 


vels  of  baseline  or  marginal  probability  assignment.  By  combining  the  three  heuristic  parameter 
sets  and  three  probability  assignments,  we  have  nine  computational  experiment  cells.  One  may 
consider  changing  the  parameters  for  individual  influence  nodes,  but  I  did  not  perform  this  com¬ 
putational  experiment  by  changing  the  individual  node  values.  Instead  of  the  individual  node  pa¬ 
rameter,  I  applied  the  level  changes  to  all  the  nodes  in  the  influence  network. 
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Table  6-4  A  table  outlining  three  levels  of  heuristic  parameters  for  task  assessment 


Influence 

Heuristic  Para¬ 
meter  Name 

Parameter  Assignment  - 

alternatives 

Level 

Network 

Node 

Very 

Low 

Low 

Medium 

High 

Very 

High 

Task  Com¬ 

Range  of  req. 
personnel 

0 

1 

2 

3-5 

6-oo 

plexity 

Range  of  req. 
expertise 

0 

0 

1-2 

3-5 

6-oo 

Task  Impor¬ 
tance 

Range  of  degree 
centrality 

0 

0- 

0.125 

0.125- 

0.25 

0.25- 

0.5 

0.5-oo 

Low  threshold 
for  assessment 

Range  of  bet¬ 
weenness  cen¬ 
trality 

0 

0- 

0.125 

0.125- 

0.25 

0.25- 

0.5 

0.5-oo 

Personnel 

Sufficiency 

Range  of  as¬ 
signed  personnel 
and  resources 
level 

0 

0- 

25% 

25-50% 

50- 

100% 

Available 

Resource 

Range  of  as¬ 
signed  personnel 
with  resource 
level 

0 

0 

1-00 

Task  Com¬ 

Range  of  req. 
personnel 

0-1 

2 

3 

4-6 

7-oo 

plexity 

Range  of  req. 
expertise 

0 

1 

2-3 

4-7 

8-oo 

Task  Impor¬ 
tance 

Range  of  degree 
centrality 

0 

0- 

0.25 

0.25-0.5 

0.5- 

0.75 

0.75- 

00 

Medium  thre¬ 
shold  for  as¬ 
sessment  (de¬ 

Range  of  bet¬ 
weenness  cen¬ 
trality 

0 

0- 

0.25 

0.25-0.5 

0.5- 

0.75 

0.75- 

00 

fault) 

Personnel 

Sufficiency 

Range  of  as¬ 
signed  personnel 
and  resources 
level 

0 

0- 

50% 

50-75% 

75- 

100% 

Available 

Resource 

Range  of  as¬ 
signed  personnel 
with  resource 
level 

0 

1 

2-oo 

Task  Com¬ 

Range  of  req. 
personnel 

0-2 

3-4 

5-6 

7-14 

15-co 

High  threshold 
for  assessment 

plexity 

Range  of  req. 
expertise 

0-1 

2-3 

4-6 

6-9 

9-oo 

Task  Impor¬ 
tance 

Range  of  degree 
centrality 

0 

0- 

0.50 

0.50- 

0.75 

0.75- 

0.90 

0.90- 

00 
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1  nf  1 ue  nee 

Heuristic  Para¬ 
meter  Name 

Parameter  Assignment 

-  alternatives 

Level  Network 

Node 

Very 

Low 

Low 

Medium 

High 

Very 

High 

Range  of  bet¬ 
weenness  cen¬ 
trality 

0 

0- 

0.50 

0.50- 

0.75 

0.75- 

0.90 

0.90- 

00 

Personnel 

Sufficiency 

Range  of  as¬ 
signed  personnel 
and  resources 
level 

0 

0- 

75% 

75-90% 

90- 

100% 

Available 

Resource 

Range  of  as¬ 
signed  personnel 
with  resource 
level 

1 

2-3 

4-oo 

Table  6-5  A  table  outlining  three  levels  of  baseline  probability  assignments 

1  nfluence  Net-  _ 

Probability  Assignment  ■ 

-alternatives 

Level 

work  Node 

Very 

Low 

Low 

Medium 

High 

Very 

High 

Task  Complexity 

0 

0.1 

0.25 

0.35 

0.4 

Task  Importance 

0 

0.1 

0.25 

0.35 

0.4 

Low  probability  assign¬ 
ment  for  baseline 

Personnel  Suffi¬ 
ciency 

0 

0.125 

0.25 

0.35 

Available  Re¬ 
source 

0.125 

0.25 

0.375 

Task  Complexity 

0 

0.25 

0.5 

0.7 

0.8 

Medium  probability  as¬ 

Task  Importance 

0 

0.25 

0.5 

0.7 

0.8 

signment  for  baseline 

(default) 

Personnel  Suffi¬ 
ciency 

0 

0.25 

0.5 

0.7 

Available  Re¬ 
source 

0.25 

0.5 

0.75 

Task  Complexity 

0.25 

0.5 

0.75 

0.8 

0.9 

Task  Importance 

0.25 

0.5 

0.75 

0.8 

0.9 

High  probability  assign¬ 
ment  for  baseline 

Personnel  Suffi¬ 
ciency 

0.25 

0.5 

0.75 

0.9 

Available  Re¬ 
source 

0.5 

0.75 

0.9 
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6.3.3.  Task  completion  likelihoods  under  computational  experiment  settings 


The  change  of  heuristic  parameters  and  baseline  probability  assignment  differentiates  the  comple¬ 
tion  likelihood  values  (seel" 


Table  6-6 


and  the  ranks  of  the  likelihoods  (see 


Table  6-7 


become  dif¬ 


ferent.  This  means  that  the  parameter  selection  will  influence  prioritizing  the  tasks  to  support  or 
prevent  by  changing  the  rank  orders  of  the  completion  likelihoods.  Under  the  default  setting,  me¬ 
dium  threshold  and  probability,  get  money  has  the  highest  completion  likelihood,  but  it  becomes 
the  sixth  highest  one  under  the  high  probability  and  low  threshold  assignment.  Therefore,  if  an 
analyst  thinks  that  the  assessment  on  the  task  support  should  be  less  strict  and  the  task  itself  has 
high  completion  probability,  get  money  would  be  less  likely  to  be  completed.  On  the  other  hand, 
overall  planning  and  execution  and  lead  attackers  to  embassy  are  the  tasks  that  would  be  more 
likely  to  be  accomplished  under  the  less  strict  assessment  and  high  completion  probability.  Since 
the  completion  rank  changes  according  to  the  assumptions  of  the  analysts,  the  qualitative  interpre¬ 
tations  of  the  analysts’  parameter  setting  should  be  provided  when  they  present  the  results. 


These  rank  and  likelihood  value  changes  can  be  explained  more  by  the  standard  deviations  of  the 
likelihoods.  Provide  money,  driving  training,  and  purchase  vehicle  have  low  standard  deviation 
across  the  computational  experiment  (ranging  from  0.149  and  0.204).  However,  tasks  such  as 
overall  planning  and  execution  and  bomb  preparation  are  the  tasks  with  high  standard  deviation 
(ranging  from  0.389  to  0.390).  They  are  inherently  complex  tasks  with  many  resources  and  exper¬ 
tise  are  involved.  Therefore,  the  changes  of  assessment  threshold  will  change  the  marginal  proba¬ 
bility  dramatically. 


These  standard  deviation  or  average  of  marginal  probability  suggests  valuable  infonnation  to 
managers  and  commanders.  These  values  address  their  key  questions  such  as  which  task  is  signif¬ 
icantly  volatile  so  that  its  completion  likelihood  swings  dramatically  when  situation  changes. 
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Table  6-6  Task  completion  likelihoods  of  tasks  under  nine  different  settings 


Low  Probability 

Medium  Probal 

bility 

High  Probability 

Low 

Med 

High 

Low 

Med 

High 

Low 

Med 

High 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Std. 

Task  Name 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

Avg. 

Dev. 

overall  planning  and  execution 

0.060 

0.023 

0.003 

0.766 

0.439 

0.031 

0.991 

0.960 

0.283 

0.395 

0.389 

load  bomb 

0.113 

0.077 

0.025 

0.493 

0.358 

0.061 

0.812 

0.773 

0.142 

0.317 

0.292 

review  surveillance  files 

0.293 

0.204 

0.066 

0.741 

0.545 

0.159 

0.898 

0.830 

0.359 

0.455 

0.291 

brief  attack  team 

0.050 

0.047 

0.009 

0.343 

0.317 

0.023 

0.766 

0.792 

0.051 

0.266 

0.298 

final  reconnaissance  mission 

0.141 

0.116 

0.051 

0.364 

0.304 

0.112 

0.650 

0.631 

0.294 

0.296 

0.209 

lead  attackers  to  embassy 

0.069 

0.045 

0.013 

0.470 

0.309 

0.037 

0.847 

0.815 

0.129 

0.304 

0.315 

clean  of  evidence 

0.082 

0.087 

0.036 

0.266 

0.294 

0.073 

0.646 

0.697 

0.135 

0.258 

0.237 

film  videotape  announcing  martyrdom 

0.238 

0.217 

0.173 

0.523 

0.496 

0.338 

0.773 

0.782 

0.543 

0.454 

0.216 

arrange  for  facilitation  and  delivery 

0.159 

0.125 

0.051 

0.432 

0.356 

0.112 

0.709 

0.694 

0.294 

0.326 

0.232 

driving  training 

0.192 

0.188 

0.089 

0.409 

0.417 

0.195 

0.630 

0.686 

0.318 

0.347 

0.195 

bomb  preparation 

0.096 

0.047 

0.002 

0.723 

0.461 

0.008 

0.975 

0.938 

0.058 

0.368 

0.390 

driving 

0.159 

0.145 

0.056 

0.435 

0.432 

0.147 

0.707 

0.758 

0.278 

0.346 

0.240 

conceal  bomb  in  car 

0.056 

0.062 

0.019 

0.204 

0.234 

0.040 

0.564 

0.625 

0.074 

0.209 

0.218 

leave  bomb  and  car 

0.130 

0.077 

0.040 

0.444 

0.284 

0.130 

0.795 

0.694 

0.335 

0.325 

0.256 

rent  residence 

0.124 

0.108 

0.025 

0.405 

0.383 

0.065 

0.706 

0.744 

0.135 

0.299 

0.259 

run  bomb  factory 

0.177 

0.126 

0.035 

0.590 

0.466 

0.108 

0.841 

0.825 

0.279 

0.383 

0.293 

purchase  vehicle 

0.215 

0.199 

0.096 

0.466 

0.448 

0.217 

0.671 

0.711 

0.370 

0.377 

0.204 

purchase  oxygen 

0.167 

0.128 

0.034 

0.533 

0.448 

0.103 

0.790 

0.793 

0.253 

0.361 

0.276 

purchase  acetylene 

0.167 

0.128 

0.034 

0.533 

0.448 

0.103 

0.790 

0.793 

0.253 

0.361 

0.276 

get  money 

0.329 

0.284 

0.199 

0.704 

0.647 

0.457 

0.845 

0.838 

0.655 

0.551 

0.228 

explosion 

0.082 

0.063 

0.017 

0.394 

0.317 

0.054 

0.802 

0.780 

0.173 

0.298 

0.289 

surveillance  of  possible  targets 

0.220 

0.196 

0.083 

0.565 

0.508 

0.191 

0.791 

0.769 

0.295 

0.402 

0.249 
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Low  Probability 

Medium  Proba 

bility 

High  Probability 

Low 

Med 

High 

Low 

Med 

High 

Low 

Med 

High 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Std. 

Task  Name 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

Avg. 

Dev. 

detonate 

0.044 

0.034 

0.007 

0.326 

0.259 

0.029 

0.828 

0.789 

0.132 

0.272 

0.305 

education  and  training 

0.102 

0.052 

0.004 

0.658 

0.385 

0.019 

0.953 

0.876 

0.136 

0.354 

0.359 

provide  money 

0.103 

0.116 

0.055 

0.186 

0.231 

0.078 

0.431 

0.500 

0.144 

0.205 

0.149 

Table  6-7  Ranks  of  task  completion  likelihoods  of  tasks  under  nine  different  settings 


Low  Probability 

Medium  Probal 

bility 

High  Probability 

Low 

Med 

High 

Low 

Med 

High 

Low 

Med 

High 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Thre¬ 

Task  Name 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

overall  planning  and  execution 

22 

25 

24 

1 

10 

21 

1 

1 

10 

load  bomb 

15 

16 

17 

11 

15 

17 

9 

14 

17 

review  surveillance  fdes 

2 

3 

6 

2 

2 

6 

4 

5 

4 

brief  attack  team 

24 

22 

21 

21 

17 

23 

16 

10 

25 

final  reconnaissance  mission 

12 

13 

9 

20 

20 

9 

21 

23 

8 

lead  attackers  to  embassy 

21 

23 

20 

12 

19 

20 

5 

7 

22 

clean  of  evidence 

19 

15 

12 

23 

21 

15 

22 

19 

20 

film  videotape  announcing  martyrdom 

3 

2 

2 

10 

4 

2 

15 

12 

2 

arrange  for  facilitation  and  delivery 

11 

11 

10 

16 

16 

10 

17 

21 

9 

driving  training 

6 

6 

4 

17 

12 

4 

23 

22 

6 

bomb  preparation 

18 

21 

25 

3 

6 

25 

2 

2 

24 

driving 

10 

7 

7 

15 

11 

7 

18 

16 

12 

conceal  bomb  in  car 

23 

19 

18 

24 

24 

19 

24 

24 

23 

leave  bomb  and  car 

13 

17 

11 

14 

22 

8 

11 

20 

5 
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Low  Probability 

Medium  Probal 

bility 

High  Probability 

Task  Name 

Low 

Thre¬ 

shold 

Med 

Thre¬ 

shold 

High 

Thre¬ 

shold 

Low 

Thre¬ 

shold 

Med 

Thre¬ 

shold 

High 

Thre¬ 

shold 

Low 

Thre¬ 

shold 

Med 

Thre¬ 

shold 

High 

Thre¬ 

shold 

rent  residence 

14 

14 

16 

18 

14 

16 

19 

17 

19 

run  bomb  factory 

7 

10 

13 

6 

5 

11 

7 

6 

11 

purchase  vehicle 

5 

4 

3 

13 

7 

3 

20 

18 

3 

purchase  oxygen 

8 

8 

14 

8 

8 

12 

14 

8 

13 

purchase  acetylene 

9 

9 

15 

9 

9 

13 

13 

9 

14 

get  money 

1 

1 

1 

4 

1 

1 

6 

4 

1 

explosion 

20 

18 

19 

19 

18 

18 

10 

13 

15 

surveillance  of  possible  targets 

4 

5 

5 

7 

3 

5 

12 

15 

7 

detonate 

25 

24 

22 

22 

23 

22 

8 

11 

21 

education  and  training 

17 

20 

23 

5 

13 

24 

3 

3 

18 

provide  money 

16 

12 

8 

25 

25 

14 

25 

25 

16 
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6.4.  Conclusion 


This  influence  network  generation  and  analysis  with  the  meta-network  concept  makes  theoretical, 
technical  and  empirical  contribution  as  well  as  has  limitations. 


Limitation:  Some  of  the  assessment  factors,  such  as  persomiel  sufficiency  and  resource  availabil¬ 
ity,  etc  might  not  be  independent  to  each  other,  which  may  lead  a  statistical  error  in  the  evaluation 
period.  However,  this  generation  scheme  is  not  a  solution  for  such  errors;  the  errors  should  be 
addressed  by  a  more  advanced  statistical  evaluation  method  of  an  influence  network.  Thus,  users 
of  this  method  should  aware  whether  these  assessment  factors  are  independent  or  not.  They 
should  not  use  the  CAST  logic  (Rosen  and  Smith,  1996)  if  they  believe  that  the  factors  are  not 
independent.  An  alternative  statistical  evaluation  approach  is  under  development  by  George  Ma¬ 
son  University. 


Another  limitation  is  that  we  regard  an  organization  as  a  closed  system  in  this  analysis.  For  ex¬ 
ample,  if  assigned  personnel  do  not  have  a  required  resource  to  perform  his  task,  the  personnel 
may  purchase  the  required  resource  from  the  outside  of  the  organization.  This  is  particularly  true 
if  the  needed  resource  is  commonly  available.  However,  this  influence  network  analysis  proce¬ 
dure  does  not  consider  such  addition  of  outside  resources  into  the  organization  of  interest.  Even 
further,  there  are  resources  that  are  not  explicitly  mentioned  in  the  meta-network,  yet  can  make 
the  task  done.  This  type  of  flexible  task  execution  is  not  also  accounted  for  this  analysis. 


Finally,  this  influence  network  generation  scheme  can  be  improved  by  adding  other  factors  of 
task  completion.  For  example,  being  at  a  specific  location  to  perform  a  task  is  an  important  factor 
of  task  completion.  However,  such  a  location  issue  is  not  discussed  in  this  chapter.  Therefore,  we 
may  add  those  additional  factors  to  this  influence  network  generation  scheme.  For  example,  we 
may  count  the  number  of  assigned  agents  at  required  locations  where  a  task  will  be  executed. 
Then,  the  human  analysts  set  a  threshold  for  the  agent  counts  at  the  locations  and  come  up  with  a 
baseline  probability  for  a  location  related  factor  belief.  The  location  related  factor  can  be  named 
as  “Assigned  agents  are  at  locations  where  task  X  will  be  executed”.  This  belief  node  can  be  add¬ 
ed  to  an  influence  network  and  linked  to  the  belief,  “Task  X  is  done.” 


Theoretic  and  technical  contribution:  1  introduced  a  new  approach  for  estimating  task  comple¬ 
tion  likelihoods  based  on  the  executing  organizational  structure  and  the  parameters  from  analyst. 
This  approach  is  an  interoperation  of  existing  two  approaches:  meta-network  and  influence  net¬ 
work.  A  meta-network  is  used  to  represent  a  complex  organizational  structure,  but  it  does  not 
have  an  evaluation  capability,  particularly  with  regard  to  task  completion.  An  influence  network 
is  a  probabilistic  model  similar  to  the  Bayesian  network  for  evaluating  the  likelihood  of  events  or 
effects  happening.  However,  its  generation  can  take  a  long  time,  and  its  results  are  based  on  the 
assumptions  made  by  its  creator.  To  mitigate  these  challenges,  I  offer  an  approach  for  generating 
an  influence  network  from  a  meta-network.  This  interoperation  enables  fast  delivery  of  an  influ- 
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ence  network  systematically  designed  from  an  organizational  structure.  This  is  a  new  approach 
that  uses  an  organizational  structure  to  estimate  the  performance  of  an  organization. 


Empirical  contribution:  I  provided  an  illustrative  example  of  the  usage  by  applying  it  to  the 
Tanzania  and  Kenya  case  dataset.  The  analysis  result  identifies  tasks  that  have  low  completion 
likelihood,  such  as  conceal  bomb  In  car  and  provide  money,  because  the  tasks  are  under¬ 
supported  by  the  organization.  From  an  adversarial  point  of  view  these  tasks  with  low  completion 
chances  are  the  tasks  that  managers  should  provide  more  support  to.  On  the  other  hand,  if  we 
want  to  lower  the  probability  of  task  success,  the  tasks  with  low  likelihood  may  be  the  ones  that 
we  should  try  to  prevent.  Surely,  tasks  require  the  different  amounts  of  effort  to  prevent  them. 
These  different  effort  requirements  mean  that  some  tasks  have  low  completion  likelihood,  a  pre¬ 
ferable  target  task  in  disrupting  the  entire  task  dependency  network,  but  they  may  require  much 
more  effort  to  prevent.  Human  analysts  will  be  responsible  for  this  further  analysis  based  on  the 
influence  network  result. 


While  this  approach  enables  the  computational  analysis  of  the  organizational  structure  and  task 
completion  likelihood,  human  analysts  should  be  careful  in  the  usage  of  the  approach.  The  para¬ 
meters  for  determining  marginal  probabilities  and  promotion,  inhibition  causalities  should  be  de¬ 
termined  with  analysts’  discretion.  We  provide  the  sensitivity  analysis  that  shows  possible  con¬ 
clusion  changes  according  to  parameter  settings.  Also,  human  analysts  should  not  consider  the 
computation  result  to  be  accurate  to  the  level  of  the  calculation  precision.  This  type  of  analysis  is 
very  prone  to  errors,  and  the  real  world  events  have  many  more  factors  that  are  not  accounted  in 
either  meta-network  or  influence  network. 

•  Task  completion  likelihood  can  be  estimated  by  examining  the  organization  support  to 
complete  the  tasks. 

•  Human  analysts  provide  their  viewpoint  toward  the  situations  and  organizations,  so 
that  the  results  can  be  adjusted  to  their  views. 

•  Dynamic  network  and  Influence  network  analyses  are  combined  to  add  a  theoretical 
component  of  assessing  organizational  performance  to  the  organizational  structure 
analysis  theories  from  the  task  completion  perspective. 

So  far,  intelligence  analysts  have  to  spend  a  long  time  to  create  an  influence  network  to  represent 
their  subject  matter  expert  viewpoints.  This  approach  provides  a  better  way  to  generate  the  influ¬ 
ence  network  by  suggesting  a  machine  generated  influence  network  to  the  analysts.  This  machine 
generated  influence  network  will  not  be  adequate  enough  to  be  used  without  any  human  correc¬ 
tions.  However,  humans  can  be  much  efficient  in  correcting  the  generated  model  and  finalize  the 
influence  network  model  ready  to  be  used  in  the  real  analysis.  This  is  a  human-machine  coopera¬ 
tion  to  use  an  existing  statistical  tool  that  was  too  complex  to  be  used  by  only  human  power. 
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7.  Building  Micro-level  Destabilization  Strategies  -  Simulating  the  Social  Behavior 

of  Adversaries 


In  many  domains  where  situations  are  dynamically  changing,  ‘what-if  analysis  is  a  critical  ques¬ 
tion  to  prepare  for  the  future.  Particularly,  some  disciplines,  such  as  intelligence,  corporate  man¬ 
agement,  military  command  and  control,  etc,  have  some  threat  scenarios  and  wonder  what  will 
happen  if  the  scenarios  become  realized.  For  example,  from  the  perspective  of  destabilization 
analysis,  an  interesting  question  is  what  will  happen  if  some  key  terrorists  are  removed.  Destabi¬ 
lization  analysts  want  to  know  the  deterioration  of  the  adversarial  organization’s  performances 
and  the  organizational  structure  after  their  removal. 


To  answer  these  questions,  the  ideal  method  is  replicating  the  target  domain  and  the  organization 
many  times  in  the  real  world  and  testing  the  scenarios  in  the  replicated  environments.  Such  expe¬ 
riments  described  above  are  approximated  by  the  organization  science  community  and  the  social 
science  community  where  researchers  investigate  field  studies  or  collect  experimental  data  in  labs. 
However,  these  techniques  are  very  expensive,  unethical  or  impossible  compared  to  the  simula¬ 
tion.  Particularly,  adversarial  organizations  are  difficult  to  replicate  in  the  real  world  because  of 
our  limited  understanding  about  the  organizations,  their  complex  collective  behavior  emerging 
from  decentralized  structures,  etc.  Multi-agent  simulation  (MAS)  has  a  number  of  benefits.  First, 
the  nature  of  the  MAS  has  a  nice  analogy  to  human  organizations  and  actors,  so  some  policy  do¬ 
mains,  such  as  civil  violence  (Epstein,  2001),  the  transportation  of  goods  (Bergkvist,  2004;Louie 
and  Carley,  2006),  used  the  MAS.  Additionally,  the  growth  of  computing  power  allows  MAS  to 
run  multiple  experiments  for  many  times  with  less  cost.  For  example,  Bio-war  MAS  (Carley, 
2006)  is  a  city  scale  model,  and  it  can  be  converged  in  several  hours  with  super  computing  facili¬ 
ties.  Finally,  the  MAS  is  now  being  used  for  theory  building  in  the  organization  and  strategy  lite¬ 
ratures  (Davis  et  al,  2006;  Cohen  et  al,1972;  March,  1991). 


Therefore,  in  this  chapter,  1  performed  the  ‘what-if  analyses  of  adversarial  organizations  under 
different  possible  intervention  scenarios,  and  the  analyses  are  done  by  a  MAS  system  called  Dy- 
net.  JDynet  contains  a  new  agent  behavior  mechanism  and  outputs  built  upon  Construct  logic,  an 
existing  multi-agent  simulation.  Specifically,  I  collected  a  structural  datasets  in  the  meta-matrix 
format,  and  the  datasets  are  introduced  in  Chapter  4.  Then,  I  modeled  the  target  organizations’ 
agent  behavior,  such  as  task  performance,  information  diffusion,  and  resource  passing.  Finally,  I 
created  hypotheses  with  dynamic  network  analysis  from  the  viewpoint  of  terrorist  removals,  and 
turned  the  hypotheses  into  simulation  scenarios.  With  the  input  organizational  structure  dataset, 
agent  behavior  model,  and  simulation  scenarios,  I  gauge  the  impact  of  the  intervention  scenarios. 
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Simulation  i  Decide  a  target  meta  network  and  values  of  the  parameters 

setting  phase 


2.  Decide  simulation  scenarios  (i.e.  strategic  interventions)  for  virtual  experiments 


Simulation 

execution 

phase 


Simulation 
result  analysis 
phase 


3.  Execute  simulations  for  multiple  times.  The  number  of  replications  should  be 
chosen  to  stabilize  the  variance  of  simulation  results. 


4.  Examine  the  simulated  organizational  performance  metrics 


5.  Apply  dynamic  network  analysis  to  evolved  meta  networks  from  the  simulations 


Figure  7-1  an  overall  analysis  procedure  of  simulations 

Before  the  starts  of  Ch.  7  and  8, 1  show  a  suggested  simulation  analysis  procedure  in  Figure  7-1 
The  simulation  analysis  in  Ch.  7  and  8  begins  by  selecting  a  target  organization  to  simulate  and 
proper  parameter  value  selections.  This  is  a  specification  applied  to  every  simulation.  In  contrast 
to  these  general  simulation  specifications,  I  can  apply  different  simulation  scenarios,  i.e.  by 
changing  who  to  remove  and  when  from  a  simulated  organization.  Each  of  these  different  simula¬ 
tion  scenarios  forms  an  experiment  cell  in  a  virtual  experiment.  Then,  I  replicate  each  experiment 
cell  with  a  coded  simulation  model.  After  the  replications,  the  simulation  model  generates  1)  or¬ 
ganizational  performances  and  general  statistics  and  2)  detailed  agent  behavior  records  over  the 
course  of  simulations.  I  use  regression  analysis,  analysis  of  variance,  and  simple  visualizations  to 
analyze  the  performance  values  and  log  records.  Particularly,  the  model  generates  an  estimated 
organizational  structures  and  element  distributions  after  the  mission  execution  in  simulations.  The 
estimated  organizational  structures  can  be  fed  back  to  the  simulation  model,  and  the  simulation 
analysis  cycle  can  starts  again. 

Throughout  this  chapter,  1  illustrate  the  model  and  application  result  by  using  the  Tanzania  and 
Kenya  dataset  introduced  in  Ch.  4.2. 

7.1.  Simulation  model  description 


JDynet  is  the  simulation  model  that  I  designed  and  used  to  estimate  the  collective  behavior  of 
adversaries  throughout  this  chapter.  JDynet  takes  a  number  of  inputs  which  are  an  adversarial 
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organizational  structure  and  parameters.  After  a  simulation  run,  JDynet  produces  an  expected  or¬ 
ganizational  structure  after  scenario  and  various  over-time  organizational  performance  scores. 
During  the  simulation,  JDynet  calculates  its  internal  status  variables  repeatedly  and  simulate  the 
time  flow.  This  analysis  procedure  incorporates  inputs,  outputs  and  simulation  model  internal 


variables.  1  summarize  the  variables  in  Table  7-1 


Table  7-1  Summary  of  identified  requirements,  related  existing  approaches  and  computational  arti¬ 
facts  supporting  the  approaches 


Type 

Name  (Default  value  in 
the  parenthesis) 

Implication 

Input 

A  networked  organizational 
structure  (a  meta-matrix) 

A  network  including  agents,  knowledge  bits,  tasks, 
and  locations.  The  network  represents  the  target  do¬ 
main’s  complex  organizational  structure. 

Simulation  scenario 

A  sequence  of  agent  removal  specification.  An  ele¬ 
ment  of  sequence  specifies  the  removal  target  agent 
and  the  removal  timing. 

Output 

An  evolved  network  organ¬ 
ization  (a  meta-matrix) 

A  network  organization  with  a  recreated  agent-to- 
agent  (AA)  network  and  an  agent-to-location  (AL) 
network,  both  of  which  reflect  organizational  element 
transfers,  social  interactions  and  geospatial  reloca¬ 
tions. 

Diffusion 

A  performance  metric  showing  how  fast  information 
can  diffuse  across  the  network. 

Energy  task  accuracy 

A  performance  metric  showing  how  accurately  in¬ 
formation  is  distributed  to  agents  who  require  it  to 
complete  their  tasks. 

Binary  task  accuracy 

A  performance  metric  showing  how  accurately 
agents  can  classify  their  binarized  assigned  tasks  with 
provided  information 

Task  completion 

A  performance  metric  displaying  what  percentage  of 
the  organization’s  tasks  are  completed 

Task  completion  speed 

A  performance  metric  displaying  how  quickly  each 
of  tasks  can  be  completed  on  average.  The  inverse  of 
the  average  task  completion  simulated  time-step 

Mission  completion  speed 

A  performance  metric  displaying  how  quickly  the 
entire  task  dependency  network  can  be  completed. 

The  inverse  of  the  mission  completion  simulated 
time-step 

Gantt  chart 

An  estimated  mission  progress  displayed  in  the  Gantt 
chart  format 

Parameters 

Number  of  time-step  (5000) 

The  number  of  simulated  time-steps 

Number  of  replications  (30) 

The  number  of  replications  to  stabilize  the  outputs  of 
this  stochastic  simulation 
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Type 

Name  (Default  value  in 
the  parenthesis) 

Implication 

Weights  for  requested  ele¬ 
ment  delivery  (0.33),  oth¬ 
ers’  request  passing  (0.33), 
or  the  agent’s  request  pass¬ 
ing  (0.33) 

Only  used  in  task  perfonnance  agent  interaction 
model.  Weights  for  selecting  an  agent  interaction 
purpose.  An  agent  selects  one  purpose  out  of  three, 
requested  organizational  element  (expertise  or  re¬ 
source)  delivery,  his  required  element  request  to  oth¬ 
ers,  or  passing  others’  request  to  different  others. 

Correct  binary  task  accura¬ 
cy  threshold  (0.5) 

When  calculating  binary  task  accuracy,  the  agents 
have  to  make  guesses  on  the  unknown  information. 

This  number  specifies  the  probability  of  the  correct 
guess 

Interaction  count  for  time- 
step  (3) 

An  agent  cannot  interact  with  another  agent  after  this 
maximum  interaction  count. 

Cognitive  power  for  time- 
step  (3) 

An  agent  can  only  respond  to  the  number  of  interac¬ 
tions  specified  by  this  parameter. 

Exchange  success  rate 
(0.75) 

If  an  agent  diffuses  information  or  passes  a  resource 
to  another  agent,  there  is  a  success  rate  of  such  trials. 

Interaction  social  distance 
radius (1) 

Interaction  candidates  are  limited  to  agents  who  are 
within  N  social  link  radius  from  the  interaction  in¬ 
itiating  agent. 

Task  execution  success  rate 
(0.5) 

When  an  agent  performs  a  task,  the  agent  can  accom¬ 
plish  the  task  with  this  success  rate.  If  the  task  is  not 
ready  (the  ready  state  is  elaborated  later),  an  agent 
cannot  perform  the  task. 

Exchange  only  required 
elements  (true) 

If  this  is  true,  agents  only  exchange  expertise  or  re¬ 
sources  only  the  receiving  agent  needs  such  elements. 

Treat  resource  as  informa¬ 
tion  (false) 

If  this  is  true,  resources  are  duplicated  when  it  is 
passed,  so  that  the  sending  and  receiving  agents  have 
the  passed  resource. 

Take  over  removed  agent 
links  (true) 

If  this  is  true,  an  agent  recognizing  that  the  interact¬ 
ing  agent  is  removed  can  take  over  the  target  agent’s 
various  links  to  organizational  elements,  other  agents 
and  assigned  tasks. 

Recognize  that  interaction 
partner  is  removed  (0.1) 

This  is  a  success  rate  that  an  agent  recognizes  the 
interaction  target  agent  is  actually  removed. 

Recover  links  from  the  re¬ 
moved  agents  (0.3) 

After  an  agent  recognizes  another  agent  is  removed, 
the  agent  can  recover  the  links  between  the  agent  and 
the  other  agent  with  this  probability 

Request  decay  time  (7) 

After  this  number  of  simulated  time-steps,  the  orga¬ 
nizational  element  request  is  removed. 

Transactive  memory  decay 
time  (7) 

After  this  number  of  simulated  time-steps,  an  agent’s 
transactive  memory  about  other  agents  is  removed. 

Maximum  transactive 

This  is  the  maximum  number  of  transactive  memory 
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Type 


Implication 


Name  (Default  value  in 
the  parenthesis) 

memory  element  (30) _ |  about  other  agents’  links 

These  inputs,  outputs  and  parameters  are  introduced  in  the  following  sections.  The  sections  ex¬ 
plain  where  the  values  are  used,  why  the  values  are  selected,  and  what  the  values’  interpretations 
are.  By  varying  these  parameters  or  inputs,  I  design  virtual  experiments  regarding  the  destabiliza¬ 
tion  of  a  target  organization.  A  human  analyst  1 )  selects  the  most  appropriate  parameter  values,  2) 
strategizes  the  agent  removal  sequence,  and  3)  runs  a  number  of  simulations  with  the  specifica¬ 
tions.  After  the  runs,  the  analyst  drills  down  the  organizational  performance  degradation  and  cor¬ 
relates  the  impact  with  his  agent  removal  sequence. 

7.1.1.  Agent  social  behavior 

JDynet  agent  behavior  is  largely  in  two  parts:  social  interaction  and  task  performance.  An  agent 
initiates  social  interactions  to  receive  expertise  or  a  resource  from  the  interaction  partner  or  to 
send  a  request  for  expertise  or  resource  to  the  partner.  An  agent  also  executes  a  task  that  is  ready 
to  be  performed.  A  task  is  ready  to  be  performed  if  all  the  prerequisite  tasks  are  done,  and  if  the 
group  of  assigned  agents  has  at  least  one  required  resource  and  expertise.  More  detailed  descrip¬ 
tions  are  in  the  below  sections.  Also,  Figure  7-2  shows  the  high  level  agent  behavior  flow  during 
the  simulations. 


7.1.2.  Selecting  an  interaction  partner  agent 


This  agent  behavior  model  is  originated  from  the  operations  research  domain  while  the  previous 
Construct  model  is  based  on  the  sociology  domain  (Carlcy,  1991).  An  agent  only  initiates  interac¬ 
tions  with  others  if  they  need  to  communicate  with  them  to  perform  his  assigned  tasks.  They  may 
seek  their  own  necessities,  pass  the  past  interaction  partner’s  request  for  resource  or  expertise,  or 
pass  the  acquired  resources  or  expertise  to  the  past  partner  who  needs  them. 


Agents  in  this  model  select  an  agent  as  an  interaction  partner  if  he  can  give  a  necessity  to  them. 
Only  when  there  is  no  agent  with  any  necessity  organizational  element,  the  agents  choose  an  inte¬ 
raction  partner  randomly.  Additionally,  an  agent  can  pass  expertise,  a  resource  as  well  as  an  ele¬ 
ment  request  that  he  or  another  past  interaction  partner  initiated.  This  model  illustrates  how  the 
agents  will  interact  when  they  are  goal-oriented.  While  the  sociological  model  is  appropriate  for 
simulating  the  belief  or  ideology  dispersion,  this  model  is  appropriate  for  simulating  the  organiza¬ 
tional  collective  behavior  to  complete  the  tasks  in  their  task  network.  This  task-completion 
oriented  agent  interaction  is  modeled  as  three  different  agent  choice  motivations  below. 


1)  Choosing  a  motivation  for  interactions:  An  agent  chooses  one  interaction  motivation  out 
of  three  motivations:  requested  element  delivery,  others’  request  passing,  and  the  agent’s 
request  passing.  This  is  a  random  weighted  selection,  and  the  weights  are  specified  by  an 
analyst,  Weights  for  requested  element  delivery,  others’  request  passing,  and  the  agent’s 
request  passing  in  Table  7-1  After  the  choice  of  the  motivation,  the  agents  select  an 


agent  as  the  following  partner  choice  mechanisms. 


2)  The  agent ’s  request  passing:  If  an  agent  chose  the  agent’s  request  passing  motivation,  the 
agent  finds  one  required-but-not-acquired  expertise  or  resource  to  perform  his  assigned 
tasks.  Then,  the  agent  searches  an  agent  who  has  the  required  organizational  element,  and 
he  initiates  an  interaction  with  the  searched  agent  to  receive  the  required  element.  If  there 
is  no  agent  with  the  required  element,  the  agent  interacts  with  a  randomly  chosen  agent 
and  leaves  a  request  for  element  delivery.  The  possible  interaction  partners  are  limited  as 
the  sociological  limit  the  interaction  candidate  set. 

3)  Others’  request  passing:  If  an  agent  chose  the  others’  request  passing  motivation,  the 
agent  finds  one  requested  element  among  the  requests  for  element  delivery  from  others. 
Rest  of  the  selection  procedure  is  identical  to  the  agent’s  request  passing  motivation.  The 
agent  searches  an  agent  who  has  the  requested  organizational  element,  and  he  initiates  an 
interaction  with  the  searched  agent  to  receive  the  required  element.  If  there  is  no  agent 
with  the  required  element,  the  agent  interacts  with  a  randomly  chosen  agent  and  leaves  a 
request  for  element  delivery.  The  possible  interaction  partners  are  limited  as  the  sociolog¬ 
ical  limit  the  interaction  candidate  set. 
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4)  Requested  element  delivery :  If  an  agent  chose  the  requested  element  delivery  motivation, 
the  agent  will  find  an  agent  who  left  a  delivery  request  during  the  past  interactions.  The 
organizational  element  in  the  delivery  request  should  be  possessed  by  the  agent.  Then, 
the  agent  initiates  an  interaction  with  the  found  agent  to  send  the  organizational  element 
that  the  interaction  partner  requested  previously. 

7.1.3.  T ransfer  an  organizational  element  or  a  delivery  request 

The  effect  of  an  interaction  between  two  agents  is  either  resource  passing,  expertise  diffusion  or 
delivery  request.  There  are  also  two  ways  of  modeling  organizational  elements  transfer.  Construct, 
a  model  that  have  been  used  in  simulating  organizational  behavior  and  evolution,  does  not  diffe¬ 
rentiate  a  resource  from  expertise  from  the  perspective  of  diffusion.  The  interaction  sender’s  re¬ 
source  is  duplicated  and  put  in  both  sender’s  and  receiver’s  possessions.  Therefore,  Construct 
way’s  interaction  result  is  diffusing  organizational  elements,  not  passing  ore  requesting. 

On  the  other  hand,  I  suggest  a  new  way  of  producing  interaction  outcomes.  First,  a  resource  is  not 
duplicated  and  just  passed  from  the  sender  to  the  receiver.  Second,  an  agent  can  leave  a  delivery 
request  for  expertise  or  a  resource,  so  that  the  interaction  partner  can  remember  that  the  initiating 
agent  needs  such  elements.  Both  ways  of  transferring  an  organizational  element  allows  only  one 
element  transfer  for  a  single  interaction.  If  the  agent  is  already  removed  or  exceeded  the  number 
of  interactions  specified  as  maximum  interaction  count  for  time-step  in  Table  7-1.  then  the  agent 
cannot  transfer  any  of  expertise  or  resources. 
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Figure  7-3  An  example  of  agent  behavior  during  the  simulation  from  the  Kenya  case  (See  Ch.  4.3.  for 
the  dataset  introduction).  The  dashed  arrows  are  the  organizational  element  ( surveillance  equipment) 
requests  to  the  interaction  partner  agents.  The  solid  arrows  are  the  actual  transfer  of  the  surveillance 
equipment.  The  solid  line  polygon  includes  Wadih  el-Hage;  arrange  for  facilitation  and  delivery;  and 
false  travel  documents.  Wadih  el-Hage  can  perform  the  arrange  for  facilitation  and  delivery  task  be¬ 
cause  he  has  the  required  resource,  false  travel  documents. 


7.1.4.  Take-over  the  removed  agent’s  expertise,  resource,  task  and  social  contacts 


If  an  agent  initiates  an  interaction  with  an  already-removed  agent,  the  interaction  initiating  agent 
may  recognize  that  the  partner  agent  is  removed  in  the  past  simulation  time-step,  so  he  is  not  res¬ 
ponding  to  the  interaction  request.  This  recognition  is  turned  on  if  an  analyst  makes  Take-over 
removed  agent  links  true.  The  recognition  also  depends  on  the  random  coin  toss  whose  probabili¬ 


ty  is  specified  as  Recognize  that  the  interaction  partner  is  removed  in  Table  7-1 


After  the  coin  toss,  if  the  agent  is  allowed  to  take-over  the  removed  agent’s  neighbor  agents,  re¬ 
sources,  expertise  and  tasks,  the  agent  creates  a  link  to  those  legacies.  However,  to  recover  the 
links  from  the  removed  agents,  the  recovering  agents  should  have  prior  knowledge  about  the  exis¬ 
tence  of  the  link.  This  is  modeled  from  the  transactive  memory.  Each  of  the  agents  has  transactive 
memory  storing  the  link  information  of  other  agents.  After  the  link  recoveries,  he  updates  the 
agent-to-agent  network  space,  so  that  the  other  agents  wouldn’t  make  more  interactions  to  the 
removed  agent. 


This  take-over  mechanism  simulates  the  resilience  of  an  adversarial  organization.  The  adversaries 
will  reassign  agents  to  resources,  expertise  and  tasks,  to  compensate  the  removed  agents. 


CMU  SCS  ISR 


-111- 


CASOS  Report 


tanzinli-kcnyi-imoon 


Mohammed  Driving 
expertise 

Abdel  Mohammed 


Khalfan 

Abdel 


Education 
and  training 


Mohammed  Driving 
expertise 


Abdel 


Education 
and  training 


Figure  7-4  A  illustrative  example  of  transactive  memory  transfer,  A  link  information,  such  as  Khal¬ 
fan  Khamis  Mohamed  is  linked  to  Fahid  Mohammed  Ally  Msalam,  can  be  transferred  through  the  in¬ 
teraction  network  among  agents.  The  transferred  transactive  memory  is  stacked  in  the  received 
agent’s  transactive  memory  repository.  After  transactive  memory  decay  time-steps,  the  decayed 
transactive  memory  element  is  removed. 


7.1.5.  Perform  an  assigned  task 

An  agent  performs  a  task  if  the  task  is  ready  for  execution.  There  are  three  statuses  for  a  task  ac¬ 
cording  to  the  resource  and  expertise  distribution  over  the  course  of  simulation. 


1)  Not  Ready.  A  task  is  not  ready  if  its  prerequisite  tasks  are  not  completed.  The  prerequisite 


tasks  are  defined  in  the  task  dependency  network  of  the  input  meta -network  (see  Table 


7-1 


2)  Ready:  A  task  is  ready  if  its  prerequisites  are  done.  However,  this  ready  status  does  not 
guarantee  the  task  completion.  The  group  of  assigned  agents  has  at  least  one  piece  of 
each  required  element  to  the  task,  but  the  group  may  not  fully  equipped  with  expertise 
and  resources  to  perform  the  task.  From  ready  status,  an  assigned  agent  can  perform  the 
task  by  coin-tossing  with  Task  execution  success  rate  probability  inf 


Table  7-1 


If  the  re¬ 
quired  resources  and  expertise  are  not  acquired  by  the  group  of  assigned  agents,  the  task 
performance  will  always  fail. 
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3)  Dons:  A  task  is  done  if  the  group  of  assigned  agents  has  the  required  expertise  and  re¬ 
sources,  at  least  one  piece,  and  if  one  of  the  assigned  agents  performed  the  task  by  suc¬ 
cessfully  coin-tossing  whose  probability  is  specified  in  Task  execution  success  rate  in 
I  Table  7-lJ 


7.2.  Virtual  experiment  design 


Virtual  experiment  design  for  destabilization  analysis  consists  of  two  parts.  First,  an  analyst  need 
to  specify  the  simulation  model  parameters,  such  as  the  number  of  simulation  time-steps,  interac¬ 
tion  ways  (either  sociology  oriented  interaction  or  operations  research  oriented  interaction), 
weights  for  interaction  methods,  etc.  Second,  an  analyst  needs  to  compose  a  simulation  scenario: 
who  to  remove  and  when.  Fundamentally,  an  analyst  can  determine  the  values  for  the  parameters 
specified  in  Table  7-1  with  his  qualitative  insights  into  a  target  organization. 


The  presented  virtual  experiment  in  this  chapter  varies  simulation  scenarios  in  three  ways:  re¬ 
moved  agent  selection  scheme,  number  of  removals,  and  removal  timings.  The  permutation  of 
these  three  factors  and  values  are  listed  in  Table  7-2  There  are  64  different  virtual  experiment 


cells  that  have  different  simulation  environment.  For  instance,  the  experiment  cells  with  larger 
intervention  size  remove  more  terrorists  over  the  course  of  simulations.  The  experiment  cells  with 
later  intervention  timing  removes  agents  relatively  late  phases  of  simulations.  Also,  the  experi¬ 
ment  cells  have  diverse  intervention  target  selection  scheme  according  to  removal  target  selection 
scheme.  This  is  the  manipulation  of  simulation  scenario.  Further  analyses  can  be  done  by  chang¬ 
ing  the  simulation  parameters,  but  such  experiments  are  not  done  in  this  thesis.  Fluman  analysts 


are  free  to  change  the  default  value  that  1  used  here  and  listed  in  Table  7-1 


and  Table  7-2 


Table  7-2  Virtual  experiment  design  for  simulation  parameters  (15  replications,  2500  simulation  time 
steps) 


Name 

Value 

Implication 

Removal  target 
selection 

scheme 

Degree,  Betweenness,  Eigen¬ 
vector  centralities  and  Cogni¬ 
tive  Demand  (4  cases) 

Agents  with  high  network  values  are  con¬ 
sidered  critical,  and  their  removal  is  critical 
to  the  organizations.  This  is  how  we  pick 
target  agents  to  remove. 

Intervention 

size 

1,  5,  9,  and  12  agent  removals 
(removing  10%,  30%,  50%  and 
70%  of  agents,  4  cases) 

The  intervention  size  specifies  how  many 
agents  to  remove  with  this  intervention. 

Intervention 

timing 

125,  250,  500,  and  1000  time- 
step  (removing  at  after  5%, 

1 0%,  20%  and  40%  timeflow, 

4  cases) 

The  intervention  happens  at  a  specific 
stage  of  simulation  period. 
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Total  virtual  64  cells 
experiment  cells  (4X4X4  cases) 


To  determine  the  agents  to  be  removed  over  the  course  of  simulations,  I  use  dynamic  network 
analysis  measures:  Degree,  Betweenness,  Eigenvector  centralities  and  Cognitive  Demand.  With¬ 
out  such  analysis,  a  human  analyst  cannot  come  up  with  a  semi -optimized  simulation  scenario 
because  of  the  vast  amount  of  possible  simulation  scenarios.  I  added  interpretations  of  the  used 


metrics  irnTable  7-3 


Table  7-3  Dynamic  network  metrics  used  to  determine  the  target  agents  to  remove 


Name 

Interpretation 

Reference 

Degree  Central¬ 

Number  of  in-coming  and  out-going  links  from  a 

Freeman, 

ity 

node,  Degree  of  direct  influence  to  others 

1979 

Betweenness 

Number  of  shortest  paths  passing  a  node,  Degree  of 

Freeman, 

Centrality 

information  flow  control 

1979 

Eigenvector 

Calculates  the  eigenvector  of  the  largest  positive  ei¬ 

Bonacich, 

Centrality 

genvalue  of  the  adjacency  matrix,  Degree  of  con¬ 
nections  to  the  high-scoring  nodes 

1972 

Cognitive  De¬ 

Measures  the  total  amount  of  effort  expended  by 

Carley, 

mand 

each  agent  to  do  his/her  tasks,  calculation  details  are 
elaborated  below. 

2002 

7.2.1.  Remove  an  agent  specified  in  the  intervention  sequence 


JDynet  is  used  to  assess  the  impact  of  intervention  strategies,  or  an  agent  removal  sequence.  In 
Table  7-1.  there  is  an  input,  Simulation  scenario.  Simulation  scenario  is  a  sequence  of  agent  re¬ 


moval  specifications.  An  agent  removal  specification  displays  the  target  agent  to  be  removed  and 
when  the  target  will  be  removed  in  the  simulation  time. 


At  the  end  of  every  time-step,  JDynet  goes  through  the  agent  lists  and  finds  an  agent  that  should 
be  removed  at  the  time-step.  If  an  agent  is  removed,  then  the  agent  cannot  make  any  actions,  ei¬ 
ther  social  interactions,  organizational  element  transfers,  or  task  performances. 

7.2.2.  Performance  measures 

To  assess  the  change  of  the  organization,  1  implemented  four  performance  metrics:  Diffusion, 
Energy  Task  Accuracy,  Binary  Task  Accuracy  and  Task  Completion.  The  performance  metrics  are 
used  to  evaluate  the  performance  of  the  evolving  organization  over  time.  Also,  I  gauge  the  inter¬ 
vention  effectiveness  by  comparing  the  perfonnance  values  to  those  of  non-intervention  case 
(baseline). 
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1)  Diffusion:  Diffusion  measures  the  dispersion  of  expertise  and  resources  across  the  agents. 


( Diffusion )  = 


A  K 

X  X  AKjj 

i=  0  /= o 

KxA 


2)  Energy  Task  Accuracy:  Diffusion  only  considers  who  knows  or  has  what.  Whereas,  ener¬ 
gy  task  accuracy  calculates  the  extent  to  which  the  agents  have  the  knowledge  they  need 
to  do  the  tasks  they  are  assigned.  This  is  done  by  introducing  the  agent-to-task  (AT)  and 
knowledge-to-task  (KT)  network  in  the  formula. 


ETA  = 


K  A 

T  X  (KTktx  X  AKak) 

1  X  k—{) _ a= 0 

Tf-0  A  K 

HATatx-ZKTkt 
a= 0  ^=0 


3)  Binary  Task  Accuracy:  Binary  task  accuracy  measures  the  agents’  binarized,  assigned 
task  classification  capability  with  the  current  information  and  resource  availability.  A 
task  classification  is  performed  by  classifying  N  organizational  elements  required  to  per¬ 
form  the  task.  An  agent  always  classifies  an  organizational  element  correctly  if  he  has  the 
element.  If  the  agent  does  not  have  an  element,  he  can  guess  the  correct  answer  with  50% 
of  chance.  Therefore,  if  an  agent  has  M  (<N)  required  elements,  then  he  has  to  guess  (N- 
M)  elements  to  get  the  result  of  the  binarized  task.  The  task  performance  is  1  if  the  agent 
classifies  more  than  50%  of  required  elements  correctly. 

4)  Task  Completion:  Task  completion  measures  the  number  of  completed  task  over  the 
course  of  the  previous  simulation  period.  A  task  is  completed  if  the  task’s  status  is  in 
done  status  as  explained  in  the  previous  section.  Task  completion  is  a  simple  ratio  calcu- 

(number  of  completed  tasks) 

lated  from  ~  ~  ~  :  ;  ;  ;  ;  ~  . 

(number  of  tasks  m  the  organizational  structur 


5)  Task  Completion  Speed:  A  task  duration  is  the  simulated  time  length  between  the  task’s 
ready  status  to  done  status.  Then,  each  task’s  speed  is  determined  by  inversing  the  task 
duration.  I  average  each  of  the  task  speeds  and  calculate  the  organization  level  task  com¬ 
pletion  speed. 

6)  Mission  Completion  Speed:  Mission  completion  speed  is  the  inverse  of  the  number  of 
simulation  time-steps  over  the  course  of  the  task  dependency  network  completion.  The 
task  dependency  network  completion  means  the  entire  task  network  completion  by  com¬ 
pleting  individual  tasks  one  by  one. 
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7.3.  Result 


I  ran  the  above  virtual  experiments  with  the  Tanzania  and  Kenya  embassy  bombing  case  (details 
are  introduced  in  Chapter  4.2.  First,  I  examine  the  agent  removal  impacts  toward  organizational 
performances.  Second,  I  observe  the  delayed  task  completion  timing  caused  by  the  agent  remov¬ 
als.  Third,  I  enumerate  the  key  individuals  over  the  course  of  simulations.  Finally,  I  visualize  the 
agents’  collective  behavior  during  the  simulations. 

7.3.1.  Impact  to  performance  measures 


After  running  four  different  simulation  scenarios  for  each  of  64  virtual  experiment  cells,  we  get 
64  simulation  results.  I  regressed  the  simulation  settings  to  the  organizational  performance  me¬ 
trics,  see  Table  7-4.  This  regression  is  done  by  using  the  two  continuous  virtual  experiment  fac¬ 
tors  (timing  and  size)  and  one  factor  (removal  selection  scheme)  with  four  categories.  There  are 
four  categories  in  the  removed  agent  selection  metrics.  I  represented  the  four  categories  by  as¬ 
signing  1  if  the  metric  is  used,  and  0  if  not  used.  According  to  the  regression  result,  earlier  inter¬ 
ventions  (smaller  intervention  timing  value)  and  larger  interventions  (larger  interventions  size) 
are  preferable  in  reducing  the  performance.  In  terms  of  the  removal  target  selection,  removing  top 
Degree  Centrality  terrorists  can  reduce  the  mission  execution  speed,  the  task  execution  speed,  the 
binary  task  accuracy  and  the  level  of  diffusion.  The  similar  trends  can  be  found  in  the  case  of  re¬ 
moving  top  Eigenvector  Centrality  terrorists. 


Table  7-4  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  virtual  experiment  settings  (treating  removed  agent  selection  scheme  with  four 
categorical  values)  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

Mission 

Speed 

Task 

Speed 

BTA 

ETA 

Diffusion 

Task 

Comple¬ 

tion 

Intervention 

Timing 

0.143* 

0.205 

-0.021 

0.081* 

-0.070* 

0.369* 

Intervention  Size 

-0.808* 

-0.063 

-0.263* 

-0.978* 

0.977* 

-0.817* 

Degree  Cent. 

-0.013 

-0.192 

-0.121 

0.044 

-0.043 

0.033 

Betweenness 

Cent. 

0.195 

0.074 

-0.166 

0.041 

-0.042 

0.132 

Eigenvector 

Cent. 

0.014 

-0.096 

-0.312* 

0.018 

-0.014 

-0.003 

Cognitive  De¬ 
mand 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

Adjusted  R- 
Square 

0.679 

0.005 

0.046 

0.958 

0.954 

0.797 

I  performed  another  regression  analysis  (see 


Table  7-5 


to  investigate  the  characteristics  of  re¬ 
moved  agents.  For  this  regression,  I  compiled  the  average  network  metrics  of  removed  agents 
and  virtual  experiment  settings.  In  overall,  again,  the  intervention  size  has  significant  influence 
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over  the  mission  speed,  energy  task  accuracy,  diffusion  and  task  completion.  If  the  intervention 
size  gets  larger,  the  above  metrics  gets  smaller.  The  intervention  timing  affects  somewhat  influ¬ 
ence  over  mission  speed,  binary  task  accuracy  and  task  completion.  If  the  intervention  timing  gets 
earlier,  the  damage  gets  larger  (and  actual  performance  values  decrease).  The  regression  indicates 
that  Eigenvector  centrality  has  higher  influence  and  important  metrics  in  predicting  the  simulated 
organizational  performance.  For  example,  if  we  choose  to  remove  low  Eigenvector  centrality 
agents,  we  can  lower  the  mission  execution  speed,  task  execution  speed,  binary  task  accuracy, 
energy  task  accuracy,  and  task  completion.  If  we  choose  to  remove  high  Degree  centrality  agents, 
we  can  reduce  the  mission  execution  speed,  task  execution  speed,  binary  task  accuracy,  energy 
task  accuracy  and  task  completion  levels. 


Table  7-5  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  calculated  metrics  of  removed  agents  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

Mission 

Speed 

Task 

Speed 

BTA 

ETA 

Diffusion 

Task 

Comple¬ 

tion 

Intervention 

Timing 

0.143* 

0.205 

-0.021 

0.081* 

-0.070* 

0.369* 

Intervention 

Size 

-2.198* 

-0.121 

-0.857 

-0.806* 

0.845* 

-1.555* 

Degree  Cent. 

-0.251 

-0.985 

-2.197* 

-0.473* 

0.542* 

-0.614 

Betweenness 

Cent. 

0.137 

-0.146 

0.465 

-0.151* 

0.142* 

0.050 

Eigenvector 

Cent. 

1.043* 

1.389 

2.587* 

0.551* 

-0.645* 

1.104* 

Cognitive  De¬ 
mand 

0.608* 

-0.319 

-0.441 

-0.184* 

0.181* 

0.219 

Adjusted  R- 
Square 

0.814 

-0.018 

0.102 

0.984 

0.982 

0.851 

One  thing  should  be  noticed  is  the  high  R-square  values.  In  typical  cases,  agent  based  social  mod¬ 
els  do  not  produce  high  R-square  values  because  inherent  randomness  and  complex  agent  beha¬ 
vioral  models.  In  contrast,  the  presented  operations  research  based  model  shows  high  R  square 
values  in  the  linear  model. 


While  this  is  an  overall  result  of  the  64  different  virtual  experiment  settings,  I  grouped  the  results 


by  their  first  factors:  target  selection  scheme,  intervention  size,  and  intervention  timing .  Figure 


7-5 


is  the  over-time  organizational  performance  evolution  of  the  virtual  experiment  cell  by  the 


first  factors. 
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Figure  7-5  Organizational  performance  over  time,  aggregated  by  the  first  factor 
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Binary  task  accuracy  converges  to  the  evolved  state  quickly  because  1  used  the  modified  version 
of  binary  task  accuracy  by  averaging  the  values  from  the  start  time  up  to  the  measure  calculation 
time.  The  energy  task  accuracy  and  diffusion  charts  exhibit  big  drops  at  the  intervention  timing: 
125,  250,  500  and  1000.  On  the  other  hand,  the  task  completion  chart  shows  gradual  damages 
over  the  course  of  simulations.  If  an  agent  is  removed  while  the  agent  is  not  needed  right  now  to 
execute  current  tasks,  then  the  agent’s  removal  does  not  decrease  the  performance  right  away. 
When  the  agent  is  needed,  the  baseline  case  can  perform  without  serious  problems,  but  the  re¬ 
moval  cases  are  damaged  when  the  time  comes.  In  terms  of  Energy  Task  Accuracy,  large  inter¬ 
vention  leaves  constant  and  permanent  damages  while  early  intervention  leaves  such  damages 
from  the  task  completion  perspective. 

7.3.2.  Impact  to  task  completion  timing 

JDynet  can  perform  more  in-depth  analysis  on  the  task  performance  of  the  adversaries  compared 
to  the  existing  Construct  model.  For  example,  JDynet  regenerates  the  task  completion  status  over 
the  simulation  period,  and  it  generates  a  task  completion  speed,  a  mission  completion  speed  and  a 
Gantt  chart.  I  investigate  these  task  completion  timing  issues. 


122.93 


Figure  7-6  Percentage  of  Task  completion  speed  to  the  baseline,  64  virtual  experiment  cells 


First,  I  show  the  task  completion  speeds  of  the  64  virtual  experiment  cells  (See  Figure  7-6 


The 


chart  value  is  the  percentage  value  of  a  specific  virtual  experiment  cell  compared  to  the  baseline 
case.  Therefore,  if  the  value  is  higher  than  100,  it  means  the  virtual  experiment  cell  has  faster  task 
completion  speed.  If  the  intervention  timing  is  late,  the  task  completion  speed  is  higher.  On  the 
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other  hand,  if  the  intervention  happens  earlier,  some  tasks  are  impossible  to  be  executed  which 
makes  their  task  completion  speed  0. 


Figure  7-6  shows  that  removing  the  high  degree  centrality  agents  is  better  in  reducing  the  task 


completion  speed.  In  most  of  the  cases,  the  degree  centrality  based  removal  shows  below  32%  of 
the  task  completion  speed  compared  to  the  base  line  (except  four  cases  that  show  101.38%, 
97.92%,  99.56%,  104.88%).  In  general,  removing  a  small  number  of  agents  at  the  late  simulation 
timing  does  not  impact  any  damage  or  sometimes  increase  the  task  execution  speed. 


Second,  I  show  the  mission  completion  speeds  of  the  64  virtual  experiment  cells.  Since  some  re¬ 
movals  disabled  the  organization  to  execute  their  entire  task  dependency  network,  the  cells  with 
successful  mission  prevention  show  0  mission  completion  speed  (infinite  execution  time).  These 
complete  mission  disables  frequently  happen  when  removing  more  than  30%  of  agents  at  the  ear¬ 
lier  stage.  If  the  interventions  are  not  successful,  some  cells  show  increased  mission  execution 
speed  (i.e.  103.55%  of  top  cognitive  demand  agent  10%  removal  at  early  stage).  Again,  large  and 
early  removals  show  better  destabilization  effect  compared  to  the  small  and  late  removals. 
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Figure  7-7  Percentage  of  Mission  completion  speed  to  the  baseline,  64  virtual  experiment  cells 
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Figure  7-8  The  estimated  Gantt  chart  of  the  baseline  case 
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Third  I  show  the  Gantt  chart  (see  Figure  7-8  of  the  baseline  to  show  the  bottleneck  tasks  and  the 
task  durations.  This  demonstrates  the  JDynet  capability  to  generate  such  a  chart  used  in  the  real 
world  and  to  identify  which  task  are  bottleneck  tasks  that  slower  the  mission  execution  speed. 
The  rent  residence  task  seems  to  have  the  longest  execution  time  and  seriously  damaging  the 
mission  execution  speed.  The  rent  residence  is  the  prerequisite  to  perform  the  run  bomb  factory 
task  which  leads  the  later  task  chains.  Because  of  the  rent  residence  task’s  delay,  other  tasks  ex¬ 
ecuted  in  the  later  phase  got  hold. 

7.3.3.  Agent  interactions  during  simulations 

I  observe  the  agent  interactions  and  organizational  element  transfers  over  the  course  of  the  simu- 
is  the  Gantt  chart  of  the  baseline  case  over  the  course  of  the  mission  execution, 
displays,  the  agents  focus  on  different  tasks  as  the  mission  progresses.  Moreo¬ 
ver,  the  agents  are  assigned  different  tasks,  which  makes  their  interactions  and  organizational 
element  transfers  change  over  time.  Table  7-6  is  the  collection  of  the  agent  interactions  and  orga¬ 
nizational  element  transfer  networks  during  the  course  of  the  simulation. 

The  agent  interaction  networks  show  no  significant  differences  over  time.  There  are  minimal 
changes  in  the  link  weights.  However,  the  agent  organizational  element  transfer  network  changes 
dramatically,  which  means  that  the  actual  usefulness  of  the  interactions  change  according  to 
whether  the  interaction  accompanies  an  organizational  element  transfer  or  not.  The  terrorists  are 
bounded  to  their  cellular  network  structure,  so  that  the  interaction  network  itself  is  not  an  obvious 
change.  We  need  to  see  the  implied  the  usefulness  of  the  interactions  by  looking  into  whether  the 
link  was  used  to  actual  resources  or  expertise  transfer.  In  the  transfer  networks,  there  are  isolated 
agents  who  are  not  utilized  during  the  particular  time  period.  In  this  case,  a  manger  may  consider 
reassigning  the  agents  to  other  tasks  which  can  be  executed  in  parallel.  Also,  a  commander  may 
consider  removing  heavily  utilized  agents  at  a  particular  time-step  when  they  can  figure  out 
which  transfer  network  is  going  on  at  the  intervention  timing.  Empirically,  Fazui  Abdullah  Mo¬ 
hammed,  A I  Owa/i  and  Wadih  ei-Hage  are  the  agents  that  consistently  appear  in  the  transfer  net¬ 
work,  which  means  that  their  removals  would  be  effective  in  any  of  time  periods. 


lation.  Figure  7-8 
As  the  Gantt  chart 
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Table  7-6  Collection  of  agent  interaction  and  organizational  transfer  network  over  time,  link  thickness  is  adjusted  to  show  the  frequency  of  the  link 
usage. 


Time  100 


Agent  to  Agent  network:  Interaction 


Agent  to  Agent  network:  Transfer  resources  and  expertise 


Time  500 
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Time  900 


Agent  to  Agent  network:  Interaction 


Agent  to  Agent  network:  Transfer  resources  and  expertise 


Time  1300 
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7.3.4.  Key  individuals  over  the  course  of  simulations 

Since  I  have  the  agent  interactions  and  organizational  element  transfers  over  the  course  of  the 
simulation,  I  can  calculate  the  network  metrics  for  the  individuals  in  the  network, 
shows  the  key  personnel  at  the  probed  time-steps  during  the  simulation.  The  key 
from  interaction  networks  do  not  change  because  the  interaction  networks  and  the  original  social 
network  are  same.  In  spite  of  the  weight  differences,  the  network  metric  values  are  same  because 
the  metrics  does  not  differentiate  the  link  weights  (the  metrics  regard  the  links  as  binary  values). 
However,  the  transfer  network  shows  the  difference  over  the  course  of  simulations.  From  the  de¬ 
gree  centrality  perspective,  Al  Owa/ihas  the  highest  importance  (at  time  300,  500,  1300),  but  the 
individual  with  the  second  highest  degree  centrality  in  the  transfer  network  changes  over  time 
(. Abdullah  Ahmed  Abdullah  at  time  300,  Khatfan  Khamis  Mohamed  at  time  500,  Mohamed  Odeh 
at  time  1300).  This  is  an  example  of  the  individual  criticality  fluctuation  over  time.  Another  ex¬ 
ample  is  the  betweenness  centrality  rank  of  Wadih  el-Hage.  He  has  the  second  highest  between¬ 
ness  centrality  in  the  transfer  network  of  the  early  stage  (time  50).  However,  his  betweenness 
rank  fluctuates  from  the  second  (time  30),  Rank  8  (time  500),  third  (Time  500),  to  second  (Time 
1300).  This  fluctuation  is  related  to  the  transfer  necessity  emerged  from  the  individuals’  task  ex¬ 
ecution  and  element  request  at  the  probing  time-step. 


Table  7-7 
individual  lists 


CMU  SCS  ISR 


-126- 


CASOS  Report 


Table  7-7  Key  individual  lists  over  the  course  of  simulations 


Time 

50 

C  ognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Abdullah  Ahmed 

Abdullah 

Osama  Bin  La¬ 
den 

A1  Owali 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

Wadih  el-Hage 

Rank 

2 

A1  Owali 

A1  Owali 

Osama  Bin  La¬ 
den 

Wadih  el-FIage 

Khalfan  Khamis 

Mohamed 

Wadih  el-Hage 

Osama  Bin  Laden 

A1  Owali 

Rank 

3 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Wadih  el-Hage 

A1  Owali 

Wadih  el-Hage 

Khalfan  Khamis 

Mohamed 

Wadih  el-Hage 

Osama  Bin  Laden 

Rank 

4 

Mustafa  Mo¬ 
hamed  Fadhil 

Mustafa  Mo¬ 
hamed  Fadhil 

Muhammed  Atef 

Khalfan  Khamis 

Mohamed 

Osama  Bin  La¬ 
den 

Osama  Bin  Laden 

Muhammed  Atef 

Abdel  Rahman 

Rank 

5 

Abdullah  Ahmed 

Abdullah 

Abdel  Rahman 

A1  Owali 

Mohammed 

Odeh 

Abdullah  Ahmed 

Abdullah 

Fazul  Abdullah 

Mohammed 

A1  Owali 

Fazul  Abdullah 

Mohammed 

Time 

300 

C  ognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Abdullah  Ahmed 

Abdullah 

A1  Owali 

A1  Owali 

A1  Owali 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Rank 

2 

A1  Owali 

A1  Owali 

Wadih  el-FIage 

Abdullah  Ahmed 

Abdullah 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Fahid  Mohaimned 
Ally  Msalam 

A1  Owali 

Rank 

3 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Osama  Bin  La¬ 
den 

Khalfan  Khamis 

Mohamed 

Wadih  el-Hage 

Osama  Bin  Laden 

Sheik  Ahmed  Salim 

Swedan 

Mustafa  Mohamed 

Fadhil 

Rank 

4 

Mustafa  Mo¬ 
hamed  Fadhil 

Mustafa  Mo¬ 
hamed  Fadhil 

Khalfan  Khamis 

Mohamed 

Mohammed 

Odeh 

Osama  Bin  La¬ 
den 

Abdullah  Ahmed 

Abdullah 

Abdullah  Ahmed 

Abdullah 

Fahid  Mohammed 
Ally  Msalam 

Rank 

5 

Abdullah  Ahmed 

Abdullah 

Abdullah  Ahmed 

Abdullah 

A1  Owali 

Mustafa  Mo¬ 
hamed  Fadhil 

Abdullah  Ahmed 

Abdullah 

Fazul  Abdullah 

Mohammed 

Mustafa  Mohamed 

Fadhil 

Ahmed  Khalfan 

Ghalilani 
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Time 

500 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Osama  Bin  La¬ 
den 

A1  Owali 

A1  Owali 

Khalfan  Khamis 

Mohamed 

Ahmed  Khalfan 

Ghalilani 

A1  Owali 

Rank 

2 

A1  Owali 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

A1  Owali 

Fahid  Mohammed 
Ally  Msalam 

Mohammed  Odeh 

Rank 

3 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Wadih  el-FIage 

Abdullah  Ahmed 

Abdullah 

Wadih  el-Hage 

Wadih  el-Hage 

Mustafa  Mohamed 

Fadhil 

Abdullah  Ahmed 

Abdullah 

Rank 

4 

Mustafa  Mo¬ 
hamed  Fadhil 

Mustafa  Mo¬ 
hamed  Fadhil 

Ahmed  Khalfan 

Ghalilani 

Wadih  el-FIage 

Osama  Bin  La¬ 
den 

Fazul  Abdullah 

Mohammed 

Khalfan  Khamis 

Mohamed 

Wadih  el-Hage 

Rank 

5 

Abdullah  Ahmed 

Abdullah 

Abdullah  Ahmed 

Abdullah 

Muhammed  Atef 

Ahmed  Khalfan 

Ghalilani 

Abdullah  Ahmed 

Abdullah 

Ahmed  Khalfan 

Ghalilani 

Sheik  Ahmed  Salim 

Swedan 

Fazul  Abdullah 

Mohammed 

Time 

1300 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Abdullah  Ahmed 

Abdullah 

A1  Owali 

A1  Owali 

Khalfan  Khamis 

Mohamed 

Wadih  el-Hage 

A1  Owali 

Rank 

2 

A1  Owali 

Mustafa  Mo¬ 
hamed  Fadhil 

Wadih  el-FIage 

Mohammed 

Odeh 

Khalfan  Khamis 

Mohamed 

Wadih  el-Hage 

Abdullah  Ahmed 

Abdullah 

Ahmed  Khalfan 

Ghalilani 

Rank 

3 

Khalfan  Khamis 

Mohamed 

A1  Owali 

Osama  Bin  La¬ 
den 

Wadih  el-Hage 

Wadih  el-Hage 

Mohammed  Odeh 

A1  Owali 

Mohammed  Odeh 

Rank 

4 

Mustafa  Mo¬ 
hamed  Fadhil 

Khalfan  Khamis 

Mohamed 

Ahmed  Khalfan 

Ghalilani 

Ahmed  Khalfan 

Ghalilani 

Osama  Bin  La¬ 
den 

Fazul  Abdullah 

Mohammed 

Osama  Bin  Laden 

Fazul  Abdullah 

Mohammed 

Rank 

5 

Abdullah  Ahmed 

Abdullah 

Abdullah  Ahmed 

Abdullah 

Muhammed  Atef 

Mustafa  Mo¬ 
hamed  Fadhil 

Abdullah  Ahmed 

Abdullah 

Ahmed  Khalfan 

Ghalilani 

Mohammed  Odeh 

Abdullah  Ahmed 

Abdullah 
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7.4.  Implementation  of  the  social  simulation  model 


The  simulation  model  is  the  agent  based  simulation  model  with  the  social  dimension.  Therefore, 
the  major  focus  of  the  implementation  should  include  the  following  two  points. 

1)  Simulation  model  iteration  management 

2)  Social  interaction  logics 

3)  Knowledge  of  space 

4)  Task  execution  logics 


This  subsection  describes  the  implementation  of  the  above  four  components  in  this  simulation 
model. 


7.4.1.  Simulation  model  iteration  management 

Simulation  iteration  is  the  main  loop  of  the  entire  model.  When  a  user  request  a  simulation  run, 
the  simulation  will  execute  this  loop  after  loading  the  simulation  model  inputs  (simulation  model 
inputs  will  be  explained  later).  This  simulation  model  runs  a  number  of  iterations  to  simulate  the 
time  flow.  These  iterations  are  controlled  by  a  loop  controlling  individual  agent  behavior.  The 
following  is  the  pseudo  code  for  coding  this  big  loop  in  a  nutshell. 


Function  main() 

Load  simulation  inputs; 

Setup  simulation  inputs; 

Setup  random; 

For  i  =  0  to  num_timestep 

simulation_iteration(random,  i ) ; 

End; 

Calculate_performance_value_for_entire_simulation(); 

Generate_simulation_outputs; 

_ End  function; _ 

Code  7-8  Geospatial  simulation  model  main  loop 


As  in  the  above  pseudo  code,  the  model  runs  the  number  of  simulated  time-step  with  a  random 
factor.  This  random  factor  makes  this  simulation  stochastic.  The  reason  behind  this  randomness  is 
explained  in  the  simulated  agent  behavior. 

Just  like  the  simulation  input  procedure,  after  the  simulation  loop  finished,  the  program  generates 
the  perfonnance  outputs.  There  are  two  different  types  of  outputs  from  this  simulation  model. 
First,  we  get  the  performance  numbers,  i.e.  task  completion  rate,  knowledge  diffusion,  task  accu¬ 
racy,  etc.  These  numbers  are  printed  out  into  files  right  away.  The  second  output  type  is  the  esti¬ 
mated  network  outputs.  These  outputs  are  recorded  in  a  DynetML  file,  so  that  the  file  can  be 
loaded  in  ORA  and  visualize  the  over-time  changes.  Thus,  Generate  simulation  output  should 
handle  these  two  types  of  outputs. 
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After  coding  this  big  loop  wrapping  the  entire  model,  we  code  the  individual  iteration  function 
that  will  be  invoked  over  time.  The  below  is  the  simulation  iteration  function. 


Function  simulation_iteration( Random  r,  int  timestep) 

Agent_behavior_order  =  Randomized_order(  1  to  num_agent); 
While(Agent_behavior_order) 

i  =  next(Agent_behavior_order); 
Execute_agent_behavior(i,  r); 

End; 

Calculate_performance_value_for_timestep( ); 

_ End  function; _ 

Code  7-9  Geospatial  simulation  iteration  for  each  time-step 


By  randomizing  the  agent  behavior  order,  we  can  simulate  the  randomness  in  the  action  frequen¬ 
cy.  Also,  by  executing  every  agent’s  behavior  for  a  single  time-step,  we  can  guarantee  that  the 
agents  will  execute  their  actions  for  the  number  of  time-step  throughout  the  simulation. 


The  simulation  main  loop  calls  the  simulation  iteration  function  for  the  number  of  time-step  times. 
The  simulation  iteration  function  calls  the  individual  agent  behavior  function  in  the  randomized 
order.  The  below  is  the  specification  of  the  individual  agent  behavior  function.  As  1  discussed 
previously,  the  agents  gather  knowledge  and  resources  and  perform  assigned  tasks  by  using  ga¬ 
thered  elements. 


Function  Execute_agent_behavior(int  agentlD,  Random  r) 
Social_interaction(agentlD,  r); 
Perform_task(agentlD,  r); 

_ End  function; _ 

Code  7-10  High  level  agent  behavior 


7.4.2.  Social  interaction  logics 

The  following  pseudo  code  is  the  social  interaction  behavior  pattern  in  the  simulation.  There  are 
three  social  interaction  motivations  as  specified  in  Ch.  7.1.2.  The  three  motivations  are  1)  re¬ 
quested  element  (knowledge  or  resource)  delivery,  2)  other’s  element  delivery  request  passing, 
and  3)  the  agent’s  element  delivery  request  generation  and  passing.  When  an  agent  has  a  chance 
to  make  a  social  interaction,  the  agent  makes  a  weighted  random  choice  to  select  one  motivation 
out  of  three.  This  weighted  random  choice  represents  the  gap  between  the  agent’s  intention  and 
action.  For  instance,  having  a  higher  probability  for  the  agent’s  element  request  generation  is  a 
representation  of  the  agent’s  intention  to  get  that  element.  However,  in  the  simulation,  he  might 
have  to  pass  other’s  element  request  because  of  the  randomness.  Then,  his  action  is  different  from 
his  intention.  Having  said  this,  if  he  has  a  far  higher  probability  for  a  certain  motivation,  then  he 
is  very  likely  to  select  the  motivation  out  of  the  random  choice.  This  reflects  the  strength  of  inten¬ 
tion  and  increasing  likelihood  of  his  intention  realization. 
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Function  Social_interaction(int  agentID,  Random  r) 

Neighboragents  =  getSphereOfInfluence(agentID,  one  social  link  away,  retumonlyagent); 
choice  =  weightedRandomChoice(r,  weightelementdelivery,  weight_others_request_passing, 
weightmyrequestgeneration); 

switch(choice) 

case  Elementdelivery: 

Element  e  =  fmd_requested_and_possessing_element(agentID’s  elements); 

Request  req  =  find_request_records_specified_by_element(agentID,s  received 
delivery  request,  e); 

If  (  req.  sender  has  done  his  interaction  for  this  turn)  finish  this  block; 

If  (  req.  sender  and  agentID  are  at  the  same  location  ) 

If  ( transferSuccessProbAtSameLocation  <  r.nextValue ) 

Unlink(agentID,e); 

Link(req.  sender,  e); 

End; 

Else 

If  ( transferSuccessProbAtDifferentLocation  <  r.nextValue  ) 
Unlink(agentID,e); 

Link(req.  sender, e); 

End; 

End; 

Removerequestrecords(req); 

Case  Others_request_passing: 

Request  req  =  fmd_request_records(agentID’s  received  delivery  request); 
interactionPartnerlD  =  pickoneagentwiththeelement 

_based_on_the_transactive_memory(agentID,  Neighbor  agents); 

If  ( interactionPartnerlD  has  done  his  interaction  for  this  turn)  finish  this  block; 

Request  newReq  =  new  Request(req. element,  agentID); 
Put_in_the_request_list(interactionPartnerID,newReq); 

Case  My  request  generation: 

Element  e  =  find_required_element_not_in_possession(agentID); 

Request  req  =  new  Request(e,  null); 

Put_in_the_request_list(agentID,req); 

End  switch; 

transactiveMemoryExchangePartnerlD  =  pick_one_agent_randomly(N  eighboragents); 
exchangeTransactionMemory(agentID,  transactiveMemoryExchangePartnerlD); 

End  function; _ 


Code  7-11  Agent’s  social  interaction  implementation  pseudo  code 


7.4.3.  Knowledge  of  space 


At  the  end  of  the  social  interaction,  the  agent  exchanges  his  transactive  memory  with  a  randomly 
selected  neighboring  agent.  This  is  a  simulation  of  interactions  passing  the  information  about  the 
current  simulated  situation.  The  transactive  memory  element  exchanges  are  done  as  the  following 
pseudo  code.  This  exchanged  transactive  memory  becomes  the  basis  for  agent  social  behavior: 
finding  required  elements,  finding  interaction  partners,  etc. 


Function  exchangeTransactiveMemory(int  agentllD,  int  agent2ID) 

Agent  INeighbornodes  =  getSphereOfInfluence(agentl,  one  social  link  away); 
Agent2_Neighbor_nodes  =  getSphereOfInfluence(agent2,  one  social  link  away); 


CMU  SCS  ISR 


-131- 


CASOS  Report 


N  =  (number  of  transactive  memory  elements  exchanged); 

For  i  =  1  to  N 

Agent  1  neighbornode  =  randomly_pick_one_node(Agent  1  Neighbornodes); 
Put_transactive_memory_tuple(  agent2ID, 

new  TransactiveMemoryElement(agentlID,  Agent  lneighbornode)); 


End; 

For  i  =  1  to  N 

Agent2_neighbor_node  =  randomly_pick_one_node(Agent2_Neighbor_nodes); 
Put_transactive_memory_tuple(  agent  1  ID, 

new  TransactiveMemoryElement(agent2ID,  Agent2_neighbor_node)); 


End; 

End  function; 


Code  7-12  Agent’s  transactive  management  pseudo  code 


7.4.4.  Task  execution  logics 


Finally,  the  agents  perform  task  execution  behavior.  A  task  is  not  ready  to  be  executed  if  the 
task’s  prerequisite  tasks  are  not  done  yet.  A  task  is  ready  to  be  executed  if  the  task’s  prerequisite 
tasks  are  done.  A  task  is  done  if  the  group  of  assigned  agents  has  all  the  required  resources, 
knowledge  and  is  placed  at  required  locations.  This  task  execution  model  is  coded  as  the  below 
pseudo  code. 


Function  Perform_task(int  agentID,  Random  r) 

task  list  =  getSphereOfInfluence(agentID,  one  social  link  away,  only  task  nodes); 
ready  task  list  =  select  only  ready  task  (task  list); 
tasktoexecute  =  randomly_pick_one_task_that_all_required 

_elemets_are_gathered(ready_task); 

If  ( taskExecutionSuccessRate  <  r.next Value ) 
recordTasklsDone(tasktoexecute); 

End; 

End  function; 


Code  7-6  Agent’s  task  execution  implementation  pseudo  code 


7.4.5.  Link  to  the  previous  description 


Figure  7-9  shows  which  simulation  flowchart  components  correspond  to  which  pseudo  codes  in 
the  previous  sections.  The  simulation  process  is  managed  by  the  simulation  model  main  loop. 
Code  7-1,  and  the  simulation  iteration  function,  Code  7-2.  In  the  simulation  iteration  function, 
each  agent  is  called  in  the  randomized  order,  and  the  agent  executes  three  aggregated  behavior 
patterns.  The  first  behavior  pattern  is  the  social  interaction  that  is  implemented  as  Agent’s  social 
interaction  implementation  pseudo  code  in  Code  7-4.  Then,  the  second  pattern  is  the  task  execu¬ 
tion  implemented  as  Agent’s  task  execution  implementation  pseudo  code  in  Code  8-6. 


CMU  SCS  ISR 


-132- 


CASOS  Report 


Figure  7-9  Annotated  simulation  procedure  flow  chart.  The  annotation  specifies  which  items  in  the 
flow  chart  correspond  to  the  pseudo  code  in  Ch.  8.5. 


Table  7-8  is  the  list  of  key  parameters.  These  parameters  are  introduced  earlier  in  Ch  7.1.  Howev¬ 
er,  the  earlier  introductions  were  about  their  types  and  implications.  Table  7-9  provides  the  links 
between  the  pseudo  code  functions  and  the  used  parameters.  This  table  will  provide  information 
about  where  the  user  parameters  are  used  in  which  part  of  the  simulation  model. 


Table  7-8  Annotated  simulation  key  parameter  table 


Name  (Default  value 
in  the  parenthesis) 

Which  pseudo  code 
function  uses  the 
parameter 

Implication 

Boost  for  interaction 
if  two  agents  are  co¬ 
located  (1.5) 

Function  So¬ 
cial  interaction 
(Code  7-4) 

If  two  interacting  agents  are  co-located, 
the  agents  will  have  higher  chances  of 
transfer  success. 

Boost  for  removal 
recognition  if  two 
agents  are  co-located 
(1.5) 

Function  So¬ 
cial  interaction 
(Code  7-4) 

If  an  agent  tries  to  recognize  one  re¬ 
moved  agent  at  the  same  location,  the 
agent  will  have  higher  chance  in  recog¬ 
nizing  the  removed  agent. 

Number  of  time-step 

Function  main  (Code 

The  number  of  simulated  time-steps 
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Name  (Default  value 
in  the  parenthesis) 

Which  pseudo  code 
function  uses  the 
parameter 

Implication 

(5000) 

7-D 

Weights  for  requested 
element  delivery  (0.33), 
others’  request  passing 
(0.33),  or  the  agent’s 
request  passing  (0.33) 

Function  So¬ 
cial  interaction 
(Code  7-4) 

Only  used  in  task  performance  agent  inte¬ 
raction  model.  Weights  for  selecting  an 
agent  interaction  purpose.  An  agent  selects 
one  purpose  out  of  three,  requested  organi¬ 
zational  element  (expertise  or  resource)  de¬ 
livery,  his  required  element  request  to  oth¬ 
ers,  or  passing  others’  request  to  different 
others. 

Interaction  count  for 
time-step  (3) 

Function  So¬ 
cial  interaction 
(Code  7-4) 

An  agent  cannot  interact  with  another  agent 
after  this  maximum  interaction  count. 

Cognitive  power  for 
time-step  (3) 

Function  So¬ 
cial  interaction 
(Code  7-4) 

An  agent  can  only  respond  to  the  number  of 
interactions  specified  by  this  parameter. 

Exchange  success  rate 
(0.75) 

Function  So¬ 
cial  interaction 
(Code  7-4) 

If  an  agent  diffuses  information  or  passes  a 
resource  to  another  agent,  there  is  a  success 
rate  of  such  trials. 

Interaction  social  dis¬ 
tance  radius (1) 

Function  So¬ 
cial  interaction 
(Code  7-4) 

Interaction  candidates  are  limited  to  agents 
who  are  within  N  social  link  radius  from  the 
interaction  initiating  agent. 

Task  execution  success 
rate  (0.5) 

Function  Perform  task 
(Code  7-6) 

When  an  agent  performs  a  task,  the  agent 
can  accomplish  the  task  with  this  success 
rate.  If  the  task  is  not  ready  (the  ready  state 
is  elaborated  later),  an  agent  cannot  perform 
the  task. 

7.5.  Conclusion 


An  existing  model,  Construct,  is  expanded  and  named  JDynet.  JDynet  includes  new  behavior  me¬ 
chanisms  and  outputs.  This  simulation  model  has  limitations  and  contributions. 


Limitations:  JDynet  has  several  issues  in  validation  and  scalability.  Validating  a  multi-agent 
model  about  adversarial  reasoning  has  been  a  problem  for  a  long  time.  Some  previous  discussions 
argue  that  a  simulation  is  not  a  recreation  of  the  real  world,  but  a  computational  generation  of 
human  behavior  identified  by  previous  qualitative  analysis.  Thus,  this  validation  problem  partial¬ 
ly  depends  on  the  viewpoint  of  the  analysts  using  the  simulation.  Scalability  is  another  problem  of 
using  this  tool.  A  stochastic  multi-agent  simulation,  just  like  JDynet,  requires  a  number  of  repli¬ 
cations  to  stabilize  the  variance  of  the  results.  If  the  analyzed  organization  has  large  size  of  agents, 
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then  the  simulation  analysis  may  take  long  time  or  impossible  depending  on  the  computational 
capability. 


Theoretical  contribution:  Multi-agent  simulation  models  have  a  capability  to  incorporate  the 
agent  behavior  models  and  organizational  structures.  Also,  it  has  an  over-time  estimation  capabil¬ 
ity,  so  that  it  has  been  used  to  virtually  experiment  policies  and  various  social  settings.  However, 
the  simulation  models  so  far  are  not  closely  linked  to  the  nuanced  outputs  such  as  a  Gantt  chart.  I 
show  that  generations  of  such  outputs  are  possible  and  useful  in  merging  operations  research  and 
management  in  the  organizational  structure  analysis. 


Technical  contribution:  I  developed  a  multi-agent  simulation  model,  JDynet,  which  is  based  on 
the  operations  research  oriented  agent  behavior  model.  Unlike  the  sociological  Construct  mode, 
which  is  a  predecessor  of  this  model,  the  agents  in  this  model  show  actual  organizational  element 
transfers  and  task  executions.  This  more  nuanced  implementation  of  agent  behavior  enables  more 
nuanced  simulation  outputs.  This  new  model  put  heavy  emphasis  on  the  task  execution  and  its 
timing,  so  I  supply  new  metrics  such  as  task  completion,  task  completion  speed  and  mission 
completion  speed.  Simulatenously,  JDynet  inherits  important  functions  of  Construct.  Agents  in 
JDynet  has  transactive  memories  that  remember  who  has  what,  or  who  knows  who.  Also,  JDynet 
takes  the  networked  organizational  structure  and  intervention  scenarios  that  Construct  can  simu¬ 
late. 


Empirical  contribution:  I  performed  virtually  experiments  with  various  intervention  scenarios 
and  with  different  settings.  I  differentiated  the  target  agent  selection  scheme,  intervention  size, 
and  intervention  timing.  I  regressed  the  virtual  experiment  to  the  various  performance  measures 
considering  the  information  diffusion,  task  execution  capability,  task  execution  speed  in  Ch.  7.3.1. 
Removing  higher  degree  agents  in  large  number  at  the  early  stage  would  be  effective  in  the  de¬ 
creasing  mission  execution  speed.  However,  this  may  not  be  achievable  in  the  real  world.  I  also 
identified  bottleneck  tasks  such  as  the  rent  residence  task  that  has  the  longest  execution  time 
across  the  tasks  during  the  mission.  It  was  a  prerequisite  to  the  run  bomb  factory  task  which  has 
many  subsequent  tasks.  You  can  find  the  detailed  Gantt  chart  in  Ch.  7.3.2.  Finally,  I  identified  the 
organizational  element  transfer  networks  among  agents.  Interactions  do  not  mean  that  the  interac¬ 
tions  were  utilized.  This  transfer  network  only  shows  the  utilized  interactions,  so  that  the  key 
players  in  this  transfer  network  is  much  meaningful  than  in  the  interaction  network.  There  are 
agents,  i.e.  Fazut  Abdullah  Mohammed,  Al  Owa/i,  and  Wad  lb  el-Hage,  who  consistently  appear  in 
the  transfer  network  over-time. 

•  Multi-agent  models  can  be  a  tool  to  assess  an  organizational  structure  and  its  evolution 
over-time. 

•  Building  a  simulation  scenario  can  be  done  by  using  Dynamic  Network  A  na/ysis. 

•  By  incorporating  further  nuanced  agent  behavior  models,  we  can  generate  nuanced 
outputs  that  are  frequently  used  in  the  real  world. 
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•  Multi-agent  simulation  models  can  estimate  the  actual  usefulness  of  interactions  by 
examining  whether  the  interaction  carried  any  organizational  element  transfers  be¬ 
tween  the  two  agents. 

I  updated  a  simulation  model  by  using  an  operations  research  idea.  This  changes  the  view  of  the 
previous  simulation  model  originated  from  the  sociological  perspective.  The  developed  mutli- 
agent  model  can  answer  more  technical  questions  with  usable  outputs.  For  instance,  managers 
have  issues  in  projecting  the  project  progress,  and  this  simulation  model  is  ready  to  answer  the 
question  with  an  estimated  Gantt  chart  output.  If  the  managers  want  to  change  the  behavior  me¬ 
chanism,  then  the  model  can  be  modified  and  answer  the  same  question  with  different  behavior 
expectations. 
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8.  Building  Micro-level  Destabilization  Strategies  -  Simulating  the  Social  and 

Geospatial  Behavior  of  Adversaries 


Sageman’s  terrorist  group  profiles  (Sageman,  2004),  Felter  and  Fishman’s  terrorist  demographic 
survey  (Felter  and  Fishman,  2007),  and  Champaign’s  terrorist  group  transnational  movement 
(Champagne  et  al.,  2005)  indicate  that  the  transnational  movement  of  adversaries  are  important. 
Therefore,  we  need  to  include  such  adversaries’  geospatial  movement  in  our  adversarial  reason¬ 
ing.  I  include  such  behavioral  pattern  in  my  reasoning  by  including  another  layer  of  agent  move¬ 
ment  in  JDynet  model,  so  turning  JDynet  into  JDynetSpatial. 


The  previous  chapter  introduced  a  model  for  simulating  adversaries’  social  behavior.  This  chapter 
extends  the  model  by  adding  adversaries’  geospatial  behavior.  Therefore,  every  model  description 
in  Ch.  7  is  implemented  in  the  simulation  model  in  Ch.  8,  so  that  this  chapter  only  explains  what 
is  added  more  than  the  model  in  Ch.  7.  Mainly,  the  adversaries’  geospatial  movements  are  mod¬ 
eled  on  top  of  the  operations  research  based  social  behavior.  The  operations  research  based  social 
behavior  aims  to  simulate  the  task  completion  driven  agent  interactions.  Similarly,  the  agents  re¬ 
locate  to  other  places  where  they  can  better  perform  their  assigned  tasks.  Such  a  task  completion 
oriented  geospatial  movements  are  modeled  by  this  extension.  Furthermore,  geospatial  move¬ 
ments  also  influence  removed  agents’  link  recovery.  If  an  agent  is  removed,  the  social  model  as¬ 
sumes  that  the  neighbors  in  the  social  network  are  able  to  recognize  the  agent  removal  and  to  re¬ 
cover  the  removed  agents’  links.  Finally,  geospatial  movements  enable  the  agents  to  collect  re¬ 
sources  or  information  that  are  not  yet  acquired  by  their  organization. 


These  extensions  to  the  previous  model  are  introduced,  and  the  approach  is  applied  to  the  1998 
U.S.  Embassy  bombing  incidents  in  Kenya  and  Tanzania  (see  Chatper  4.2.  for  further  introduc¬ 
tion).  This  dataset  is  different  from  the  Kenya  dataset  that  have  been  used  in  this  work.  Over  the 
course  of  the  incident,  the  terrorists  have  to  extensively  move  around  regions  and  cross  the  bor¬ 
ders  to  align  the  resources  and  expertise  for  the  execution.  In  contrast,  the  Kenya  dataset  is  li¬ 
mited  to  the  activities  within  a  single  state,  Kenya. 


8.1.  Simulation  model  description 


To  implement  the  extensions,  I  added  several  parameters  to  the  previous  model.  The  added  para- 

should  be  considered  as  well 


meters  are  listed  in|  Table  8-1 
asl 


Table  8-1 


Therefore,  the  parameters  in  Table  7-1 


in  this  chapter. 
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Table  8-1  Summary  of  additional  parameters  to  model  the  geospatial  behavior  of  adversaries 


Type 

Name  (Default  value  in  the 
parenthesis) 

Implication 

Input 

Geospatial  agent  distribution 
networks  in  a  meta-network 

If  an  agent  is  located  at  a  certain  place,  the 
place  should  be  linked  to  the  agent,  and  this 
is  an  Agent-to-Location  network. 

Geospatial  organizational 
element  distribution  net¬ 
works  in  a  meta-network 

If  an  organizational  element  (resource  or 
expertise)  is  located  at  a  certain  place,  the 
place  should  be  linked  to  the  element,  and 
this  is  a  Resource-to-Location  network  or  an 
Expertise-to-Location  network. 

Geospatial  task  allocation 
network  in  a  meta-network 

If  a  task  has  to  be  done  at  a  specific  loca¬ 
tion,  then  the  task  and  the  location  should  be 
linked  in  a  Task-to-Location  network. 

Geospatial  Transportation 
network  among  Locations  in 
a  meta-network 

If  an  agent  can  move  from  one  place  to 
another  place,  then  the  two  places  should  be 
linked  in  a  Location-to-Location  network. 

Output 

An  evolved  network  organi¬ 
zation  (a  meta-matrix) 

Estimated  Agent-to-Location  (AL)  networks 
over-time 

Number  of  agents  at  loca¬ 
tions 

Estimated  number  of  agents  in  a  location  at 
a  certain  time-step. 

Parameters 

Probability  on  successful  re¬ 
gional  resource  and  expertise 
gathering  (0.5) 

Probability  for  collecting  a  location-held 
expertise  and  resources  by  an  agent. 

Change  timing  of  the  geos¬ 
patial  destination  (5) 

When  an  agent  selects  a  place  to  move,  he 
will  cross  a  location-to-location  link  for 
each  time-step.  In  this  case,  the  agent  will 
keep  his  first  selected  location  as  a  destina¬ 
tion  for  the  number  of  time-step  specified  by 
this  parameter. 

Boost  for  interaction  if  two 
agents  are  co-located  (1.5) 

If  two  interacting  agents  are  co-located,  the 
agents  will  have  higher  chances  of  transfer 
success. 

Boost  for  removal  recogni¬ 
tion  if  two  agents  are  co¬ 
located  (1.5) 

If  an  agent  tries  to  recognize  one  removed 
agent  at  the  same  location,  the  agent  will 
have  higher  chance  in  recognizing  the  re¬ 
moved  agent. 

Weights  for  task  perfor¬ 
mance  (0.70),  link  recovery 
(0.10),  interaction  facilitation 
(0.10),  and  new  re¬ 
source/expertise  acquisition 

Weights  for  selecting  a  location  to  move.  An 
agent  selects  one  relocation  purpose  out  of 
four.  An  agent  may  move  to  a  location  to 
execute  a  task  to  be  done  at  a  specific  loca¬ 
tion.  An  agent  may  move  to  the  interaction 
partner’s  location  to  facilitate  interactions. 
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Type  Name  (Default  value  in  the  Implication 
parenthesis) 

(0.10)  An  agent  may  move  to  the  removed  agent’s 

location  to  recover  the  agent’s  links.  An 
agent  may  move  to  new  locations  to  acquire 
needed  resources  and  expertise. 

8.1.1.  Agent  social  and  geospatial  behavior 

The  main  point  of  this  agent  behavior  model  is  that  the  agent  can  perform  both  social  interaction 
and  geospatial  movement.  An  agent  has  to  select  an  interaction  partner  agent  as  well  as  a  reloca¬ 
tion  destination.  Therefore,  as  the  agent  chooses  an  interaction  partner  in  the  previous  model,  the 
agent  chooses  a  place  to  move  in  this  model.  While  an  agent  decides  where  to  go,  the  agent  has 
four  different  intentions  for  the  relocation.  Such  relocation  intentions,  regional  resource/expertise 
collections,  or  various  boosting  effects  toward  interactions  and  removal  recognitions  are  ex¬ 
plained  in  this  section.  I  provide  a  high  level  behavior  flowchart  in  Figure  8-1 


Figure  8-1  Agent  behavior  logic.  Compared  to  the  previous  behavior  model,  the  geospatial  relocation 
and  the  regional  resource/expertise  acquisitions  are  added.  Furthermore,  some  of  the  existing  models, 
such  as  recognizing  the  removed  agents  or  transferring  organi 
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8.1.2.  Selecting  a  location  to  move 


As  the  agent  interaction  behavior  needs  to  determine  an  interaction  partner,  the  agent  relocation 
behavior  needs  to  select  a  destination  location.  The  destination  location  is  determined  by  a  relo¬ 
cating  agent’s  specific  intention.  There  are  four  possible  intentions:  to  perfonn  an  assigned  task 
that  has  to  be  carried  out  at  a  specific  place,  to  acquire  an  organizational  element  that  the  agent 
needs  to  perform  his  assigned  tasks,  to  recover  the  removed  agents’  lost  links  to  organizational 
elements,  social  contacts  and  assigned  tasks,  and  to  facilitate  the  interaction  by  moving  to  the 
place  where  the  interaction  partner  is.  One  remaining  intention  is  a  random  place  choice.  I  explain 
each  of  motivations  in  detail  below.  Mainly,  I  use  Sageman’s  and  Champagne  et  al.’s  descriptions 
(Sagemam,  2004;  Champagne,  2005)  about  terrorists’  geospatial  movements  and  model  the  inten¬ 
tion  of  geospatial  movement  according  to  their  descriptions  about  terrorists’  transnational  move¬ 
ment  pattern. 


Performing  assigned  tasks  at  specific  places:  An  agent  may  move  to  a  specific  location  to  per¬ 
fonn  tasks  that  have  to  be  done  at  the  location.  On  page  5,  Champagne  et  al.  (2005)  says  that  “Be¬ 
tween  1993  and  1994,  members  of  al  Qaeda  began  to  re-locate  to  Eastern  Africa,  including  Sudan 
and  Kenya.”  According  to  them,  the  relocation  reason  is  training  their  soldiers  and  attacking  the 
western  targets.  These  relocations  can  be  modeled  as  the  relocation  to  perfonn  a  specific  task. 
This  location  requirement  in  the  task  execution  is  represented  as  the  Task-to-Location  network  in 
the  meta  network.  For  instance,  the  actual  bombing  mission  of  the  Kenya  and  Tanzania  incidents 
should  happen  in  the  cities  of  Kenya  and  Tanzania  where  the  U.S.  embassies  are.  Therefore,  the 
bombing  mission  executors,  not  terrorists  for  preparation  or  support,  should  be  actual  bombing 
sites.  This  motivates  the  terrorists  move  to  the  specific  locations,  and  this  motivation  is  modeled 
by  this  simulated  motivation. 


Acquiring  required  organizational  elements:  An  agent  may  move  to  a  location  where  the  agent 
can  acquire  expertise  and  resources  required  for  performing  assigned  tasks.  On  page  50,  Sageman 
(2004)  describes  where  the  terrorists  are  trained.  Salim  al-Hazmi  made  a  transnational  movement 
from  his  home  country,  Saudi  Arabia,  to  Afghanistan,  where  the  al-Qaeda  training  camp  is.  This 
is  an  act  of  expertise  seeking  to  perfonn  his  task.  1  modeled  this  movement  by  using  simulated 
movement  intention.  In  this  the  Embassy  bombing  data,  the  al-Qaeda  organization  has  extensive 
training  facilities  in  Somalia  and  Afghanistan,  which  is  also  represented  in  the  datasets  that  I  am 
using.  The  terrorists  may  move  to  the  locations  to  acquire  weapons,  bomb  expertise  or  import 
bomb  ingredients.  This  requires  the  terrorists’  relocations,  and  this  requirement  is  modeled  by  this 
relocation  motivation. 

Facilitating  efficient  interactions  between  the  interaction  partners:  An  agent  may  move  to  a 
location  where  his  interaction  partner  is.  On  page  144,  Sageman  (2004)  explains  that  the  early 
contribution  of  Montreal,  Milan  and  Madrid  to  the  Jihad  movement  is  caused  by  the  presence  of 
various  terrorists  in  the  locations.  He  explains  that  these  terrorists’  presence  in  the  locations  as  the 
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geospatial  characteristics  and  the  Jihad  movement  is  caused  in  these  cities.  Therefore,  I  assume 
that  the  presence  of  the  terrorists  will  attract  more  terrorists  at  a  specific  location  to  simulate  this 
trend.  Being  at  the  same  location  often  shows  more  productive  interaction  outcomes:  faster  exper¬ 
tise  transfer,  easier  resource  movement.  This  does  not  mean  that  the  co-location  is  a  requirement 
for  such  organizational  element  transfer,  but  this  means  that  the  co-location  makes  the  transfer 
success  rate  higher  in  the  simulation  model. 


Better  recovering  a  removed  agent’s  links  to  other  agents,  resources,  expertise  and  tasks: 
An  agent  is  able  to  recover  a  removed  agent’s  links  to  organizational  elements.  On  page  56, 
Champagne  et  al.  (2005)  records  that  Wadih  el-Hage  and  Fazul  Abdullah  Mohamed  went  to  Lake 
Victoria  to  investigate  the  drowning  of  Abu  Ubaida  al  Banshiri.  This  relocation  is  motivated  by 
an  agent  removal  in  their  organization.  This  can  be  modeled  in  this  order:  1)  remember  the  re¬ 
moved  agent’s  links,  2)  try  to  recover  the  links  that  the  recovering  agent  does  not  have,  3)  recov¬ 
ers  only  parts  of  links  that  are  selected  by  the  simulation  model  (some  link  recoveries  are  unsuc¬ 
cessful  because  1)  some  resources  are  only  in  the  recovering  agent’s  transactive  memory  and  not 
consistent  with  the  simulation  status,  2)  there  is  a  random  factor  in  the  recovery,  tossing  a  coin 
with  a  probability  of  link  recovery,  specified  as  Recover  links  from  the  removed  agents, 


7-1 


Table 


Being  at  the  same  location  improves  the  Recover  links  from  the  removed  agents  by  boosting 


the  value.  This  results  in  more  successful  link  recoveries  that  the  recovering  agent  tries. 


8.1.3.  Regional  resource  and  information  gathering 


An  agent  performs  a  regional  resource,  expertise  gathering  for  each  turn  of  their  behavior.  This 
means  that  the  agent  has  one  more  chance  to  acquire  a  resource  and  expertise.  In  the  previous 
social-only  model,  those  acquisitions  only  happened  over  the  course  of  an  interaction  between 
two  agents.  This  model  allows  such  social  link  oriented  resource,  expertise  transfer  as  well  as 
geospatial  oriented  acquisition.  A  geospatial  location  is  treated  as  a  social  agent  except  the  fact 
that  the  location  cannot  initiates  an  interaction  in  spite  that  the  location  can  hold  expertise  or  re¬ 
sources  for  giving  them  to  social  agents.  This  is  tightly  linked  to  the  movement  motivation  of  ac¬ 
quiring  required  organizational  elements,  explained  in  Ch.  8.1.2. 


Moreover,  the  social  link  orient  resource,  expertise  transfer  can  be  more  successful  by  being  at 
the  same  location  with  the  interaction  partner.  This  is  different  from  the  previous  case  because 
this  social  link  oriented  transfer  can  happen  without  being  at  the  same  location.  The  co-location 
only  increases  the  chance  of  success,  not  necessary  to  the  transfer.  The  increase  is  done  by  using 
the  parameter,  exchange  success  rate  inlTable  7-1  land  boost  for  interaction  if  two  agents  are  co¬ 


located  in  Table  8-1 


and  the  below  formula. 


(exchange  success  rate  for  two  agents  at  the  same  location) 

=  (boost  for  interaction  if  two  agents  are  colocated) 
X  (exchange  success  rate) 
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Because  of  these  effects  of  better  organizational  element  transfer,  the  agents  has  two  different 
motivations  for  relocation:  acquiring  required  organizational  elements  and  facilitating  efficient 
interactions  between  the  interaction  partners. 

8.1.4.  Take-over  the  removed  agent’s  expertise,  resource,  task  and  social  contacts 
considering  the  regional  distribution 


By  being  at  the  same  location,  an  agent  has  a  better  chance  of  recovering  the  removed  agent’s 
links  to  organizational  elements,  such  as  other  agents,  resources,  expertise  and  tasks.  This  im¬ 
provement  in  link  recoveries  is  modeled  as  the  below  formula.  The  formula  uses  two  parameters: 
recover  links  from  the  removed  agents  in 


agents  are  co-tocated in  Table  8-1 


Table  7-1 


and  boost  for  removal  recognition  if  two 


(Recover  links  from  the  removed  agent  at  the  same  location) 

=  (Recover  links  from  the  removed  agents) 

X  (Boost  for  removal  recognition  if  two  agents  are  colocated) 


This  geospatial  effects  is  related  to  the  geospatial  relocation  motivation,  better  recovering  a  re¬ 
moved  agent’s  links  to  other  agents,  resources,  expertise  and  tasks  in  Ch.  8. 1 .2. 

8.1.5.  Perform  an  assigned  task  considering  the  geospatial  dimension 


An  agent  is  required  to  be  a  specific  location  if  the  task  should  be  done  at  the  location.  For  exam¬ 
ple,  Figure  8-2  shows  a  sub-graph  of  the  detonate  Task.  The  task  should  be  done  at  two  specific 
locations,  Kenya  and  Tanzania.  Therefore,  at  least  two  agents  are  required  to  perform  this  task 
because  one  agent  cannot  be  at  two  different  locations.  Two  or  more  agents  should  be  at  Kenya 
and  Tanzania,  at  least  one  agent  for  each  location.  Then,  the  located  agents  can  toss  a  coin  that 
determines  the  success  of  the  particular  task.  This  is  not  a  probabilistic  requirement  that  contri¬ 
butes  the  task  success  rate.  This  is  a  hard  requirement  for  agent  distribution  over  the  geospatial 
regions.  To  model  this  motivation  of  relocation,  I  implemented  a  relocation  motivation,  perform¬ 
ing  assigned  tasks  at  specific  places. 
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Figure  8-2  A  sub-network  of  the  Tanzania  and  Kenya  meta-network,  a  set  of  nodes  within  one  social 
link  radius  from  detonate,  The  set  includes  Kenya  and  Tanzania 


CMU  SCS  ISR 


-142- 


CASOS  Report 


8.2.  Virtual  experiment  design 


Virtual  experiment  design  for  the  extended  version  of  JDynetSpatial  is  same  to  the  experiment 
design  in  the  previous  chapter.  In  the  real  world,  human  analysts  qualitatively  analyze  the  given 
situation  and  decide  the  simulation  parameters,  but  this  virtual  experiment  uses  an  illustrative  si¬ 


mulation  parameters  specified  in  Table  7-1 


and  Table  8-1 


The  virtual  experiment  design  differentiates  three  factors:  who  to  remove,  when  to  remove,  and 
how  many  agents  to  remove.  The  virtual  experiment  selects  a  set  of  agents  who  have  high  net¬ 
work  values  as  a  set  of  removed  agents.  To  calculate  the  network  values,  I  use  four  different  net¬ 
work  measures:  Degree,  Betweenness,  Eigenvector  centralities  and  Cognitive  demand.  The  set 
size  of  the  removed  agents  is  another  factor  in  the  virtual  experiment  design.  Also,  the  timing  of 
the  removals  is  another  factor  in  the  experiment  design. 


Table  8-2  Virtual  experiment  design  for  simulation  parameters  (30  replications,  2500  simulation 
time-steps) 


Name 

Value 

Implication 

Removal  target 
selection 

scheme 

Degree,  Betweenness,  Eigen¬ 
vector  centralities  and  Cogni¬ 
tive  Demand  (4  cases) 

Agents  with  high  network  values  are  con¬ 
sidered  critical,  and  their  removal  is  critical 
to  the  organizations.  This  is  how  we  pick 
target  agents  to  remove. 

Intervention 

size 

1,  5,  9,  and  12  agent  removals 
(removing  10%,  30%,  50%  and 
70%  of  agents,  4  cases) 

The  intervention  size  specifies  how  many 
agents  to  remove  with  this  intervention. 

Intervention 

timing 

125,  250,  500,  and  1000  time- 
step  (removing  at  after  5%, 

1 0%,  20%  and  40%  timeflow, 

4  cases) 

The  intervention  happens  at  a  specific 
stage  of  simulation  period. 

Total  virtual 
experiment  cells 

64  cells 

(4x4x4  cases) 

8.3.  Result 


1  present  the  simulation  results  in  three  sections.  First,  I  analyze  the  general  organizational  per¬ 
formance  results  from  strategic  interventions.  Second,  1  analyze  the  timing  of  task  and  mission 
completions.  Third,  1  analyze  the  estimated  agent  social  and  geospatial  behavior  in  detail. 
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8.3.1.  Impact  to  performance  measures 


The  previously  defined  organizational  perfonnances  are  examined.  Since  there  are  several  ex¬ 
tended  agent  behavior  mechanisms  to  include  geospatial  mechanisms,  some  organizational  per¬ 
formances  exhibit  different  tendencies  compared  to  the  results  from  the  social-only  model.) 


8-3 


Table 


is  the  regression  analysis  result  from  the  64  virtual  experiments  with  the  virtual  experiment 


settings.  Obviously,  the  intervention  Size  is  the  key  factors  in  explaining  the  changes  in  the  per¬ 
formance  compared  to  the  baseline.  The  mission  speed,  task  speed,  energy  task  accuracy  and  task 
completion  goes  down  as  the  intervention  sizes  increases.  The  earlier  intervention  is  better  by 
looking  at  the  positive  standardized  coefficients  of  the  coefficient  values  in  the  regression  model 
of  the  mission  speed,  task  speed,  energy  task  accuracy,  and  task  completion.  There  is  no  clear 
trend  in  the  network  metrics.  However,  there  are  some  coefficients  which  stand  out,  i.e.  removing 
higher  degree  centrality  terrorists  would  decrease  the  mission  speed  more. 


Table  8-3  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  virtual  experiment  settings  (treating  removed  agent  selection  scheme  with  four 
categorical  values)  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

Mission 

Speed 

Task 

Speed 

BTA 

ETA 

Diffusion 

Task 

Comple¬ 

tion 

Intervention 

Timing 

0.521* 

0.355* 

0.470* 

0.129* 

-0.142* 

0.602* 

Intervention  Size 

-0.663* 

-0.337* 

0.013 

-0.981* 

0.975* 

-0.630* 

Degree  Cent. 

-0.058 

0.142 

0.036 

0.040 

-0.027 

0.002 

Betweenness 

Cent. 

0.053 

0.073 

0.092 

0.018 

-0.023 

0.050 

Eigenvector 

Cent. 

-0.008 

0.090 

0.017 

0.013 

-0.010 

-0.012 

Cognitive  De¬ 
mand 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

Adjusted  R- 
Square 

0.678 

0.171 

0.144 

0.960 

0.952 

0.725 

Moreover,  1  performed  another  regression  analysis  by  predicting  the  organizational  perfonnances 
with  removed  agents’  network  position  characteristics.  1  averaged  the  network  measure  values  of 
the  removed  agents  and  regressed  the  averaged  value  to  the  organizational  perfonnance  values, 
which  is  different  from  using  the  categorical  value  of  the  virtual  experiment  setting.  Still,  earlier 
interventions  (positive  intervention  timing  coefficients),  larger  intervention  sizes  (negative  inter¬ 
vention  size  coefficients)  and  higher  betweenness  centrality  sizes  (negative  coefficients)  are  pre¬ 
ferable  in  increasing  the  amount  of  damage  toward  the  organizational  performances. 
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Table  8-4  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  calculated  network  metrics  of  the  removed  agents  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

Mission 

Speed 

Task 

Speed 

BTA 

ETA 

Diffusion 

Task 

Comple¬ 

tion 

Intervention 

Timing 

0.521* 

0.355* 

0.470* 

0.129* 

-0.142* 

0.602* 

Intervention  Size 

-1.464* 

-0.153 

-0.775 

-0.773* 

0.794* 

-1.141* 

Degree  Cent. 

-0.443 

0.714 

-0.191 

-0.494* 

0.501* 

-0.628 

Betweenness 

Cent. 

0.228 

-0.074 

0.501 

-0.133* 

0.144* 

0.134 

Eigenvector 

Cent. 

0.809 

-1.118 

0.251 

0.548* 

-0.589* 

0.916 

Cognitive  De¬ 
mand 

0.263 

0.377 

0.318 

-0.214* 

0.209* 

0.085 

Adjusted  R- 
Square 

0.730 

0.207 

0.199 

0.988 

0.980 

0.761 

Figure  8-3  shows  the  organizational  performance  over-time.  In  terms  of  Energy  Task  Accuracy 


and  Diffusion,  removing  more  terrorists  increase  the  inflicted  damage,  i.e.  see  the  curve  of  inter¬ 
vention  size  70%.  However,  from  the  task  completion  perspective,  early  interventions  are  more 
important  and  leave  more  prolonged  damage  to  the  organizations.  This  suggests  that  the  interven¬ 
tion  tactic  should  be  adjusted  according  to  the  objective  of  the  intervention.  If  a  human  analyst 
wants  to  stop  the  spread  of  expertise  and  aligning  resource  distributions,  then  the  analyst  should 
focus  on  removing  more  agents.  If  the  analyst  wants  to  prevent  an  event  occurring,  then  the  ana¬ 
lyst  should  focus  on  removing  agents  earlier. 


Additionally,  it  should  be  noted  that  the  late  interventions  (removing  agents  after  40%  of  time- 
steps)  and  the  small  interventions  (removing  only  1 0%  of  agents)  do  not  make  significant  damage 
in  task  completion  over  time.  Therefore,  such  interventions  do  not  result  in  the  disruption  of  their 
task  performance  and  should  be  avoided. 
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Figure  8-3  Organizational  performance  over-time 
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8.3.2.  Impact  to  mission  and  task  completion  timing 


The  strategic  interventions  impact  the  mission  and  task  completion  timings.  Figure  8-4 


are  two 


estimated  Gantt  charts  from  two  virtual  experiment  cells.  One  (the  upper  Gantt  chart)  is  from  the 
baseline,  and  the  other  (the  bottom  Gantt  chart)  is  from  the  case  removing  10%  of  top  degree  cen¬ 
trality  terrorists  at  the  early  stage  (after  5%  of  simulation  time  passed).  Many  of  other  experiment 
cells  show  no  finishing  timing  of  the  mission,  which  means  that  the  intervention  disabled  the  or¬ 
ganization  to  perform  the  mission  within  2500  simulation  time-step.  In  the  baseline  case,  no  in¬ 
terventions,  the  organization  can  finish  the  mission  around  859  simulation  time-steps,  as  shown  in 
the  upper  Gantt  chart  in  Figure  8-4.  but  the  intervention  case  shows  the  mission  completion 
around  881  time-steps.  From  the  mission  finish  time  perspective,  there  is  no  significant  damage 
from  the  interventions.  However,  the  individual  task  completion  timings  of  the  two  cases  become 
different.  The  two  Gantt  charts  are  similar  until  the  125  time-step,  but  after  the  interventions  at 
the  125  time-step,  the  task  completion  timings  get  different.  For  instance,  after  the  intervention,  it 
takes  more  time  to  finish  lead  attackers  to  embassy,  driving,  and  bomb  preparation  tasks.  At  the 
same  time,  some  tasks,  i.e.  run  bomb  factory,  conceal  bomb  in  car  and  dean  of  evidence,  etc,  take 
shorter  time. 


These  longer  task  execution  times  are  caused  by  the  rest  of  agents’  spent  time  for  recovering  the 
removed  agents  contacts,  resources  and  expertise  to  perform  the  task.  Actually,  after  recovering 
the  removed  agents’  organizational  elements  and  social  contacts,  the  rest  of  the  agents  can  per¬ 
form  the  task  at  the  same  speed  or  faster  speed  in  some  cases  (since  the  social  network  gets 
smaller  and  agents  are  tightly  connected  than  before). 


CMU  SCS  ISR 


-148- 


CASOS  Report 


provide_money 
education_and_training 
final_reconnaissance_mission 
arrangeforfacilitationanddelivery 
surveillance_of_possibl  e_ta  rgets 
getmoney 
reviewsurveillancefiles 
purchase_vehicle 
purchase_acetylene 
purchaseoxygen 
rentresidence 
brief_attack_team 
drivingtraining 
driving 
runbombfactory 
bomb_preparation 
overall_planning_and_execution 
load_bomb 
conceal_bomb_in_car 
lead_attackers_to_embassy 
leave_bomb_and_car 
detonate 

filmvideotapeannouncingmartyrdom 

explosion 

cleanofevidence 


0 


100 


200 


300 


400 


500 


600 


700 


900 


providemoney 
education_and_training 
final_reconnaissance_mission 
a  rrange_for_facil  itation_a  nd  _d  el  i  very 
su  rveil  I  ance_of_possi  bl  e_ta  rgets 
get_money 
review_surveillance_files 
purchase_vehicle 
purchase_oxygen 
purchase_acetylene 
rent_residence 
brief_attack_team 
drivingtraining 
driving 

overall_planning_and_execution 

run_bomb_factory 

bomb_preparation 

load_bomb 

conceal_bomb_in_car 

lead_attackers_to_embassy 

leave_bomb_and_car 

detonate 

film_videotape_announcing_martyrdom 

explosion 

clean_of_evidence 


0 


100 


200 


300 


400 


500 


600 


700 


800 


900 


Figure  8-4  Two  Gantt  charts  from  Baseline  (Upper)  and  10%  removal  of  top  degree  centrality  agent  removals  at  the  early  stage  (after  %  of  simulation 
time  step) 


CMU  SCS  ISR 


-149- 


CASOS  Report 


Figure  8-5  displays  the  overall  mission  completion  results  across  the  virtual  experiment  cells.  The 


measures  are  bar  charts,  and  there  are  4X4X4  bars  corresponding  to  4  target  decision  measures, 
4  intervention  timings  and  4  intervention  sizes.  If  the  bar  shows  0  mission  speed,  it  means  that  the 
experiment  cell  could  not  complete  the  entire  task  dependency  network,  or  a  mission.  For  exam¬ 
ple,  when  removing  the  top  betweenness  agents,  the  10%  and  30%  agent  removals  decrease  the 
mission  speed  (sometimes,  it  increases  according  to  timings),  but  the  50%  and  70%  agent  remov¬ 
als  cause  complete  mission  failure  unless  the  intervention  happens  at  the  late  stage.  Actually,  the 
betweenness  centrality  turned  out  to  be  the  worst  metric  in  deciding  the  target  in  the  simulation 
results  because  the  rest  of  agents  could  recover  the  removed  agents’  social  links  and  the  connec¬ 
tions  get  much  tighter.  On  the  other  hand,  the  degree  centrality  seems  to  be  the  best  metric  in  de¬ 
terring  the  mission  completion.  As  shown  in  Figure  8-5.  30%,  50%  and  70%  interventions  at  the 
early  (after  5%  of  simulation  time-steps)  or  early-middle  stage  (after  10%  of  simulation  time- 
steps)  successfully  disrupt  the  adversaries’  mission. 


Figure  8-5  Four  mission  speed  bar  charts  for  four  intervention  strategic  schemes  (betweenness  at 
top-left,  cognitive  demand  at  top-right,  eigenverctor  at  bottom-left,  and  degree  at  bottom-right),  The 
number  is  the  percentage  of  the  mission  speed  compared  to  the  baseline),  which  means  100%  =  same 
as  baseline,  less  than  100%  =  slower,  and  more  than  100%  =  faster.  If  the  speed  is  0,  then  the  cell 
could  not  complete  the  mission. 


Figure  8-6  represents  the  task  speed  results  across  the  virtual  experiment  cells.  Given  that  the  mis¬ 


sion  completion,  or  the  completion  of  entire  task  dependency  network,  is  difficult  in  many  of  vir¬ 
tual  experiment  cells,  their  mission  speed  are  usually  zero  indifferently.  Therefore,  task  speed  is 
calculated.  The  task  speed  is  the  averages  of  the  inversed  task  performance  durations  (See  section 
7.1.5).  Compared  to  Figure  8-5.  Figure  8-6  outlines  more  differentiated  destabilization  effect  of 
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strategic  interventions.  Earlier  interventions  are  preferable  as  the  mission  speed  analysis.  Howev¬ 
er,  there  is  no  serious  difference  effect  from  differentiating  the  intervention  sizes.  Many  cases 
suggest  that  the  late  intervention  might  increase  the  task  execution  speed.  This  is  due  to  the  tigh¬ 
tened  social  network  after  removals  if  the  network  was  able  to  recover  the  social  links  and  re-link 
adversaries. 


133.12 


105.38 


Figure  8-6  Four  task  speed  bar  charts  for  four  intervention  strategic  schemes  (betweenness  at  top-left, 
cognitive  demand  at  top-right,  eigenverctor  at  bottom-left,  and  degree  at  bottom-right),  The  number 
is  the  percentage  of  the  mission  speed  compared  to  the  baseline),  which  means  100%  =  same  as  base¬ 
line,  less  than  100%  =  slower,  and  more  than  100%  =  faster. 


8.3.3.  Agent  movements  and  interactions  during  simulations 


Compared  to  the  social  only  model  in  the  previous  chapter,  the  distinct  feature  of  the  geospatial 
and  social  model  is  that  the  agents  can  move  to  other  locations  and  collect  regional  resources  and 
expertise.  Therefore,  the  tool  can  generate  visualizations  of  the  agents’  interactions  and  move- 

is  the  Gantt  chart  over  the 


ments  in  the  baseline  case  (See  Figure  8-7 


and  Table  8-6 


Figure  8-7 


course  of  the  mission  execution  in  the  baseline  and  the  line  chart  showing  how  many  agents  were 
at  a  certain  location  and  when.  Many  of  training  tasks  were  done  at  Somalia,  and  some  of  re¬ 
sources  and  resource  holding  agents  were  at  Afghanistan.  Therefore,  until  400  time-step,  there 
were  noticeable  agent  presence  in  Pakistan  and  Afghanistan.  However,  as  the  mission  proceeds, 
and  as  the  Kenya  and  Tanzania  regional  tasks  increases,  the  agents  move  from  the  training  and 
resource  acquisition  places  to  actual  bombing  places,  Kenya  and  Tanzania.  Thus,  the  later  phase 
of  the  simulation  shows  that  the  agents  in  Somalia,  Afghanistan  and  Pakistan  move  to  Kenya  and 
Tanzania. 


CMU  SCS  ISR 


-151- 


CASOS  Report 


providemoney 
educationandtraining 
finalreconnaissancemission 
arrangeforfacilitationanddelivery 
surveillance_of_possibl  e_ta  rgets 
getmoney 
reviewsurveillancefiles 
purchase_vehicle 
purchase_acetylene 
purchaseoxygen 
rent_residence 
brief_attack_team 
driving_training 
driving 
run_bomb_factory 
bombpreparation 
overall_planning_and_execution 
load_bomb 
conceal_bomb_in_car 
lead_attackers_to_embassy 
leave_bomb_and_car 
detonate 

film_videotape_announcing_martyrdom 

explosion 

clean_of_evidence 


800 


900 


Figure  8-7  A  Gantt  chart  and  an  agent-geospatial  distribution  over-time  line  chart  of  Baseline.  As  the  task  dependency  network  gets  completed,  the 
agents  move  to  new  locations  where  they  can  perform  the  next  tasks.  The  initial  training  center  at  Somalia  and  the  resource  deposit  of  Afghanistan  are 
attracted  agents  till  the  400  time-steps.  After  the  initial  trainings  and  resource  acquisition,  the  actual  bombing  tasks  in  Kenya  and  Tanzania  make  the 
agents  to  segregate  in  Kenya  and  Tanzania 
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Table  8-5  Collection  of  agent  interaction  and  organizational  transfer  network  over  time,  link  thickness  is  adjusted  to  show  the  frequency 
of  the  link  usage. 
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Table  8-6  Collection  of  agent  geospatial  movements  and  transnational  movement  passage  networks  over  time,  link  thickness  is  adjusted  to 
show  the  frequency  of  the  link  usage. 
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Geospatial  visualization  of  meta-network 


Location-to-location  transnational  movement  network 
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Table  8-5  shows  further  details  of  the  agent  behavior.  First,  the  interaction  network  shows  which 
social  links  are  frequently  used  for  interactions.  Not  all  of  the  social  links  in  the  organizational 
structures  are  utilized  as  an  interaction  channel.  Some  of  social  links  are  much  heavily  used,  i.e.  a 
link  between  Ahmed  the  German  and  Abdullah  Ahmed  Abdullah.  Moreover,  not  all  of  the  interac¬ 
tions  were  effective  from  the  perspective  of  resources  and  expertise  transfer.  The  organizational 
element  transfer  network  shows  that  only  a  part  of  interaction  networks  were  utilized  for  re¬ 
sources  and  expertise  passing,  i.e.  a  link  between  Fazut  Abdullah  Mohamed  and  Ahmed  Khalfan 
Ghalilani.  Additionally,  the  agnet-to-agent  organizational  element  transfer  network  changes  over 
time  (particularly,  the  link  weights).  This  change  is  driven  by  the  mission  process  over  time. 

This  adversarial  organization  had  five  distinct  transnational  operational  bases  (see  Table  8-6  .  To 
manage  the  team  and  to  execute  the  mission,  their  organizational  structure  was  also  international. 
The  geospatial  distribution  shows  the  agents  segregation  levels  at  the  five  different  regions  and 
the  organizational  structure  laid  over  the  middle-eastern  region.  This  shows  the  location  criticality 
and  the  transnational  interaction  network.  Finally,  the  agents  had  to  move  from  one  base  to 
another  base,  which  require  transnational  mobility.  The  geospatial  agent-relocation  network 
shows  the  frequency  of  such  transnational  movements  between  two  regions.  The  edge  thickness 
represents  heavy  traffic  between  two  location  nodes.  For  instance,  Kenya  and  Tanzania  is  always 
linked  with  heavy  edge  weights  due  to  extensive  agents’  transnational  movement  between  the  two 
regions. 

8.3.4.  Key  individuals  over  the  course  of  simulations 

From  the  baseline  case’s  recorded  interaction  and  transfer  networks  among  agents,  1  calculate  the 
network  metrics  to  see  the  adversaries’  importance  over  the  course  of  simulations.  There  are  no 
big  changes  in  the  interaction  networks  compared  to  the  changes  of  transfer  networks.  The  inte¬ 
raction  networks  are  more  stable  because  the  agents  use  most  of  social  relations  for  the  interac¬ 
tions  during  the  simulations  though  the  frequencies  of  the  relation  usages  are  different.  The  used 
social  network  metrics  only  consider  the  links  as  a  binary  value,  so  the  link  usage  frequency  is  not 
reflected  in  the  key  individual  lists. 

The  key  individual  lists  of  the  agnet-to-agent  transfer  networks  show  interesting  changes  in  the 
rosters.  A/  Owali'S  betweenness  centrality  in  the  transfer  network  is  the  highest  value  at  time  50 
and  300,  but  he  is  ranked  at  the  third  at  time  500  and  the  fifth  at  time  1300.  This  gradual  decrease 
in  his  betweenness  centrality  suggests  his  role  change  over  time.  Wadih  el-Hage  is  another  inter¬ 
esting  terrorist.  His  degree  centrality  in  the  interaction  network  is  ranked  at  top  five  all  the  time. 
However,  his  degree  centrality  in  the  transfer  network  shows  large  fluctuation.  He  is  ranked  at  the 
top  at  time  50  and  at  the  third  at  time  500.  At  time  300  and  time  1300,  his  degree  centrality  is 
ranked  out  of  top  five.  This  suggests  that  he  often  becomes  the  center  of  interaction,  but  not  the 
center  of  organizational  element  transfer.  Therefore,  an  analyst  might  think  that  his  shown  inte¬ 
raction  may  not  over-reflect  his  importance  from  the  organizational  element  transfer. 
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Table  8-7  Key  individual  lists  over  the  course  of  simulations 


Time 

50 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Osama  Bin  La¬ 
den 

Wadih  el-Hage 

A1  Owali 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

Wadih  el-Hage 

Rank 

2 

A1  Owali 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

A1  Owali 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

Rank 

3 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Wadih  el-Hage 

Osama  Bin  Laden 

Wadih  el-Hage 

Osama  Bin  Laden 

Wadih  el-Hage 

A1  Owali 

Rank 

4 

Mustafa  Mo¬ 
hamed  Fadhil 

Mustafa  Mo¬ 
hamed  Fadhil 

Muhammed  Atef 

Muhammed  Atef 

Osama  Bin  La¬ 
den 

Wadih  el-Hage 

Mohammed 

Odeh 

Fazul  Abdullah 

Mohammed 

Rank 

5 

Abdullah  Ahmed 

Abdullah 

Abdel  Rahman 

A1  Owali 

Khalfan  Khamis 

Mohamed 

Abdullah  Ahmed 

Abdullah 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Osama  Bin  Laden 

Time 

300 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Osama  Bin  La¬ 
den 

Khalfan  Khamis 

Mohamed 

A1  Owali 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

Mustafa  Mohamed 

Fadhil 

Rank 

2 

A1  Owali 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

A1  Owali 

Khalfan  Khamis 

Mohamed 

Osama  Bin  Laden 

Wadih  el-Hage 

Fahid  Mohammed 
Ally  Msalam 

Rank 

3 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Wadih  el-Hage 

Ahmed  Khalfan 

Ghalilani 

Wadih  el-Hage 

Khalfan  Khamis 

Mohamed 

Osama  Bin  Laden 

Khalfan  Khamis 

Mohamed 

Rank 

4 

Mustafa  Mo¬ 
hamed  Fadhil 

Mustafa  Mo¬ 
hamed  Fadhil 

Muhammed  Atef 

Mustafa  Mohamed 

Fadhil 

Osama  Bin  La¬ 
den 

Wadih  el-Hage 

Muhammed  Atef 

Sheik  Ahmed  Salim 

Swedan 

Rank 

5 

Abdullah  Ahmed 

Abdullah 

Abdel  Rahman 

Ahmed  Khalfan 

Ghalilani 

Fahid  Mohammed 
Ally  Msalam 

Abdullah  Ahmed 

Abdullah 

Fazul  Abdullah 

Mohammed 

Ali  Mohammed 

Ahmed  Khalfan 

Ghalilani 
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Time 

500 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank  1 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Abdullah  Ahmed 

Abdullah 

Ahmed  Khalfan 

Ghalilani 

A1  Owali 

Wadih  el-Hage 

Abdullah  Ahmed 

Abdullah 

Ahmed  Khalfan 

Ghalilani 

Rank  2 

A1  Owali 

A1  Owali 

Osama  Bin  La¬ 
den 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Osama  Bin  La¬ 
den 

A1  Owali 

Mustafa  Mohamed 

Fadhil 

Rank  3 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Wadih  el-FIage 

Wadih  el-Hage 

Wadih  el-Hage 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Rank  4 

Mustafa  Mo¬ 
hamed  Fadhil 

Mustafa  Mo¬ 
hamed  Fadhil 

Khalfan  Khamis 

Mohamed 

Mustafa  Mo¬ 
hamed  Fadhil 

Osama  Bin  La¬ 
den 

A1  Owali 

Ahmed  Khalfan 

Ghalilani 

Fahid  Mohammed 
Ally  Msalam 

Rank  5 

Abdullah  Ahmed 

Abdullah 

Abdel  Rahman 

Ahmed  Khalfan 

Ghalilani 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

Khlid  A1  Fawaz 

Wadih  el-Hage 

Sheik  Ahmed  Salim 

Swedan 

Time 

1300 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank  1 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Abdullah  Ahmed 

Abdullah 

Muhammed  Atef 

A1  Owali 

Mustafa  Mo¬ 
hamed  Fadhil 

Abdullah  Ahmed 

Abdullah 

Anas  al-Liby 

Rank  2 

A1  Owali 

Mustafa  Mo¬ 
hamed  Fadhil 

Wadih  el-FIage 

Mustafa  Mo¬ 
hamed  Fadhil 

Khalfan  Khamis 

Mohamed 

Khalfan  Khamis 

Mohamed 

Osama  Bin  La¬ 
den 

Muhammed  Atef 

Rank  3 

Khalfan  Khamis 

Mohamed 

A1  Owali 

Osama  Bin  La¬ 
den 

Anas  al-Liby 

Wadih  el-Hage 

Osama  Bin  La¬ 
den 

Wadih  el-Hage 

Osama  Bin  Laden 

Rank  4 

Mustafa  Mo¬ 
hamed  Fadhil 

Khalfan  Khamis 

Mohamed 

Ahmed  Khalfan 

Ghalilani 

Osama  Bin  La¬ 
den 

Osama  Bin  La¬ 
den 

Mohammed 

Odeh 

Muhammed  Atef 

A1  Owali 

Rank  5 

Abdullah  Ahmed 

Abdullah 

Abdel  Rahman 

Khalfan  Khamis 

Mohamed 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

A1  Owali 

A1  Owali 

Abdel  Rahman 
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8.4.  Simulation  result  comparison  between  the  social  only  model  and  the  social 
and  geospatial  model 


Ch.  7  and  8  shows  a  multi-agent  simulation  model  only  simulating  the  social  dimension  and  an 
extended  model  simulating  the  social  and  geospatial  dimensions,  respectively.  The  expansion  is 
motivated  by  the  importance  of  adversaries’  geospatial  relocation  and  transnational  movement 
behavior.  By  adding  this  additional  interaction  layer  for  the  simulated  agents,  we  can  enable  new 
analyses  and  obtain  different  analysis  results. 


First,  I  enabled  new  analysis  results  that  cannot  be  provided  by  the  social  only  model.  Ch.  8.3.3. 
shows  the  impact  of  adding  the  additional  layer.  The  similar  analysis  in  Ch  7.3.3.  was  limited  to 
the  visualization  of  agent  interactions  at  the  social  dimension.  An  analyst  using  the  model  has  no 
idea  about  estimations  on  adversaries’  movement.  Ch  8.3.3.  provides  an  estimated  level  of  geos¬ 
patial  segregation  of  adversaries.  Furthermore,  visualizations  of  transnational  movement  passage 
networks  show  the  importance  of  transnational  movement  between  two  nations,  i.e.  extensive 
geospatial  movement  between  Tanzania  and  Kenya  at  the  end  stage,  adversaries’  segregation  in 
Somalia  and  Afghanistan  at  the  early  simulation  stage,  etc.  These  new  analysis  results  provide 
insights  into  where  the  adversaries  are  segregated  and  when  and  why. 


Second,  adding  a  new  interaction  layer  changes  the  existing  simulation  results.  For  instance,  the 
key  individual  lists  are  different  between  the  social  only  model  and  the  combined  model.  Abdul¬ 
lah  Ahmed  Abdullah  has  the  highest  degree  centrality  in  the  interaction  network  from  the  social 
only  model  at  timg  50.  Flowever,  the  same  network  from  the  social  and  geospatial  model  at  the 
same  timing  indicates  that  Osama  Bln  Laden  has  the  highest  degree  centrality  (seel" 


Table  8-8 


Additionally,  the  regression  analyses  in  Ch.  7  and  8  are  different.  For  instance,  removing  higher 
cognitive  demand  agents  help  decreasing  the  task  speed,  binary  task  accuracy  and  energy  task 
accuracy  level.  Flowever,  in  the  social  and  geospatial  model,  such  removals  induce  the  decrease 
only  in  the  energy  task  accuracy,  (see  Table  8-8|. 


Table  8-8  Different  results  from  the  social  only  model  and  the  social  and  geospatial  model 


Comparison  Point 

Result  from  Social  Only 

Model 

Result  from  Social  and  Geos¬ 
patial  Model 

Used  simulation 
results  for  com¬ 
parison 

Effect  of  earlier  interven¬ 
tion  timing  to  organization¬ 
al  performances 

Increased  damage  in  mission 
speed,  task  speed,  energy  task 
accuracy,  and  task  completion 
Decreased  damage  in  binary 
task  accuracy  and  diffusion 

Increased  damage  in  mission 
speed,  task  speed,  binary  task 
accuracy,  and  task  completion 
Decreased  damage  in  diffusion 

Table  7-5 

Table  8-4 

and 

Effect  of  larger  intervention 
size  to  organizational  per¬ 
formance 

Increased  damage  in  mission 
speed,  task  speed,  binary  task 
accuracy,  energy  task  accuracy, 
and  task  completion 

Decreased  damage  in  diffusion 

Increased  damage  in  mission 
speed,  task  speed,  binary  task 
accuracy,  energy  task  accuracy, 
and  task  completion 

Decreased  damage  in  diffusion 

Table  7-5 

Table  8-4 

and 
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Comparison  Point 

Result  from  Social  Only 

Model 

Result  from  Social  and  Geos¬ 
patial  Model 

Used  simulation 

results  for  com¬ 
parison 

Effect  of  removing  higher 
degree  centrality  agents  to 
organizational  performance 

Increased  damage  in  mission 
speed,  task  speed,  binary  task 
accuracy,  and  task  completion 
Decreased  damage  in  diffusion 

Increased  damage  in  mission 
speed,  binary  task  accuracy, 
energy  task  accuracy,  and  task 
completion 

Decreased  damage  in  task 
speed  and  diffusion 

Table  7-5 

Table  8-4 

and 

Effect  of  removing  higher 
betweenness  centrality 
agents  to  organizational 
performance 

Increased  damage  in  task  speed 
and  energy  task  accuracy 
Decreased  damage  in  mission 
speed,  binary  task  accuracy, 
diffusion,  and  task  completion 

Increased  damage  in  task  speed 
and  energy  task  accuracy 
Decreased  damage  in  mission 
speed,  binary  task  accuracy, 
diffusion,  and  task  completion 

Table  7-5 

Table  8-4 

and 

Effect  of  removing  higher 
eigenvector  centrality 
agents  to  organizational 
performance 

Increased  damage  in  diffusion 
Decreased  damage  in  mission 
speed,  task  speed,  binary  task 
accuracy,  energy  task  accuracy, 
and  task  completion 

Increased  damage  in  task  speed 
and  diffusion 

Decreased  damage  in  mission 
speed,  binary  task  accuracy, 
energy  task  accuracy,  and  task 
completion 

Table  7-5 

Table  8-4 

and 

Effect  of  removing  higher 
cognitive  demand  agents  to 
organizational  performance 

Increased  damage  in  task  speed, 
binary  task  accuracy,  and  ener¬ 
gy  task  accuracy 

Decreased  damage  in  mission 
speed,  diffusion  and  task  com¬ 
pletion 

Increased  damage  in  energy 
task  accuracy 

Decreased  damage  in  mission 
speed,  task  speed,  binary  task 
accuracy,  diffusion  and  task 
completion 

Table  7-5 

Table  8-4 

and 

Top  agent  in  interaction 
network  at  the  early  stage 
(time  50) 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohamed 

Degree  Centrality:  Abdullah 
Ahmed  Abdullah 

Betweenness  Centrality:  A1 

Owali 

Eigenvector  Centrality:  Abdul¬ 
lah  Ahmed  Abdullah 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  Osama  Bin 
Laden 

Betweenness  Centrality:  A1 

Owali 

Eigenvector  Centrality:  Abdul¬ 
lah  Ahmed  Abdullah 

Table  7-7 

Table  8-7 

and 

Top  agent  in  transfer  net¬ 
work  at  the  early  stage 
(time  50) 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  Osama  Bin 
Laden 

Betweenness  Centrality:  A1 

Owali 

Eigenvector  Centrality:  Wadih 
el-EIage 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  Wadih  el- 
Hage 

Betweenness  Centrality:  A1 

Owali 

Eigenvector  Centrality:  Wadih 
el-Hage 

Table  7-7 

Table  8-7 

and 

Top  agent  in  interaction 
network  at  the  middle  stage 
(time  500) 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  Osama  Bin 
Laden 

Betweenness  Centrality:  A1 

Owali 

Eigenvector  Centrality:  Ahmed 
Khalfan  Ghalilani 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  Abdullah 
Ahmed  Abdullah 

Betweenness  Centrality:  A1 

Owali 

Eigenvector  Centrality:  Abdul¬ 
lah  Ahmed  Abdullah 

Table  7-7 

Table  8-7 

and 

Top  agent  in  transfer  net¬ 
work  at  the  middle  stage 
(time  500) 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  A1  Owali 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  Ahmed 

Table  7-7 

Table  8-7 

and 
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Comparison  Point 

Result  from  Social  Only 

Model 

Result  from  Social  and  Geos¬ 
patial  Model 

Used  simulation 

results  for  com¬ 
parison 

Betweenness  Centrality:  Khal- 
fan  Khamis  Mohamed 
Eigenvector  Centrality:  A1 

Owali 

Khalfan  Ghalilani 

Betweenness  Centrality:  Wadih 
el-Hage 

Eigenvector  Centrality:  Ahmed 
Khalfan  Ghalilani 

Top  agent  in  interaction 
network  at  the  late  stage 
(time  1300) 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  Abdullah 
Ahmed  Abdullah 

Betweenness  Centrality:  A1 

Owali 

Eigenvector  Centrality:  Wadih 
el-EIage 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  Abdullah 
Ahmed  Abdullah 

Betweenness  Centrality:  A1 

Owali 

Eigenvector  Centrality:  Abdul¬ 
lah  Ahmed  Abdullah 

Table  7-7 

Table  8-7 

and 

Top  agent  in  transfer  net¬ 
work  at  the  late  stage  (time 
1300) 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  A1  Owali 
Betweenness  Centrality:  Khal- 
fan  Khamis  Mohamed 
Eigenvector  Centrality:  A1 

Owali 

Cognitive  Demand:  Fazul  Ab¬ 
dullah  Mohammed 

Degree  Centrality:  Muhammed 
Atef 

Betweenness  Centrality:  Musta¬ 
fa  Mohamed  Fadhil 

Eigenvector  Centrality:  Anas 
al-Liby 

Table  7-7 

Table  8-7 

and 

8.5.  Implementation  of  the  social  and  geospatial  simulation  model 


I  describe  the  implementation  procedure  of  the  introduced  simulation  model.  The  simulation 
model  is  the  agent  based  simulation  model  with  the  social  and  geospatial  dimensions.  In  other 
words,  this  simulation  model  is  an  iteration  of  agents  within  the  four  specified  interaction  spaces. 
Therefore,  the  major  focus  of  the  implementation  should  include  the  following  two  points. 


5)  Updated  social  interaction  logic 

6)  Updated  knowledge  of  space 

7)  New  geospatial  movement  logic 

8)  Updated  task  execution  logic 

This  subsection  describes  the  implementation  of  the  above  four  components  in  this  simulation 
model.  This  social  and  geospatial  model  is  built  on  top  of  the  social  model,  so  I  only  listed  the 
changes  in  the  social  model  to  account  for  the  geospatial  dimension. 

Before  I  start  explaining  the  details  of  updated  logics,  I  show  what  the  big  changes  are  in  Code  8- 
3.  In  the  social  and  geospatial  model,  I  put  the  geospatial  relocation  logic  right  after  the  social 
interaction  logic,  so  that  the  agent  can  behave  in  the  two  different  spaces.  Therefore,  the  geospa¬ 
tial  relocation  part  is  completely  new  compared  to  the  social  only  model,  but  the  social  interaction 
and  task  performance  parts  are  updated  components. 
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Function  Execute_agent_behavior(int  agentID,  Random  r) 
Social_interaction(agentID,  r); 
Geospatial_relocation(agentID,  r); 
Perform_task(agentID,  r); 

End  function; _ 


Code  8-1  High  level  updated  agent  behavior 


8.5.1.  Updated  social  interaction  logic 


The  following  pseudo  code  is  the  updated  social  interaction  behavior  pattern  in  the  simulation.  As 
you  can  see,  the  delivery  success  rate  changes  according  to  whether  the  interaction  happens  at  the 
same  location  or  not.  This  enables  new  incentive  about  moving  to  interaction  partners  for  agent. 


Function  Social_interaction(int  agentID,  Random  r) 

Neighboragents  =  getSphereOfInfluence(agentID,  one  social  link  away,  retum  only  agent); 
choice  =  weightedRandomChoice(r,  weight  element  delivery,  weight_others_request_passing, 
weightmyrequestgeneration); 

switch(choice) 

case  Element  delivery: 

Element  e  =  fmd_requested_and_possessing_element(agentID’s  elements); 

Request  req  =  find_request_records_specified_by_element(agentID,s  received 
delivery  request,  e); 

If  (  req.  sender  has  done  his  interaction  for  this  turn)  finish  this  block; 

If  (  req.  sender  and  agentID  are  at  the  same  location  ) 

If  ( transferSuccessProbAtSameLocation  <  r.nextValue ) 

Unlink(agentID,e); 

Link(req.  sender,  e); 

End; 

Else 

If  ( transferSuccessProbAtDifferentLocation  <  r.nextValue  ) 
Unlink(agentID,e); 

Link(req.  sender, e); 

End; 

End; 

Removerequestrecords(req); 

Case  Others_request_passing: 

Request  req  =  find_request_records(agentID’s  received  delivery  request); 
interactionPartnerlD  =  pickoneagentwiththeelement 

_based_on_the_transactive_memory(agentID,  Neighbor  agents); 

If  ( interactionPartnerlD  has  done  his  interaction  for  this  turn)  finish  this  block; 

Request  newReq  =  new  Request(req. element,  agentID); 
Put_in_the_request_list(interactionPartnerID,newReq); 

Case  My  request  generation: 

Element  e  =  find_required_element_not_in_possession(agentID); 

Request  req  =  new  Request(e,  null); 

Put_in_the_request_list(agentID,req); 

End  switch; 

transactiveMemoryExchangePartnerlD  =  pick_one_agent_randomly(N  eighboragents); 
exchangeTransactionMemory(agentID,  transactiveMemoryExchangePartnerlD); 

End  function; 
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Code  8-2  Agent’s  social  interaction  implementation  pseudo  code 


8.5.2.  Updated  knowledge  of  space 


Knowledge  of  space  is  exchanged  and  represented  as  transactive  memories  held  by  agents.  How¬ 
ever,  there  are  no  changes  to  this  transactive  memory  model.  I  modeled  the  locations  as  nodes  and 
distance  as  networks  among  location  nodes.  Therefore,  there  is  no  need  to  make  additional 
changes  if  the  transactive  memory  is  able  to  transfer  the  links  among  any  types  of  nodes.  There¬ 
fore,  the  links  between  locations  and  agents,  knowledge,  resources  and  tasks  will  be  additionally 
transferred  from  one  agent  to  another,  but  such  transaction  would  not  need  any  of  transactive 
model  implementation  change  if  you  follow  the  concept  of  meta-network  which  treats  locations 
as  just  a  different  type  of  nodes. 


8.5.3.  New  geospatial  movement  logic 


This  model  specifies  the  agent  movement  logics,  as  well.  I  described  the  implement  in  the  below 
pseudo  code.  There  are  four  motivations  that  make  agents  relocate.  The  four  motivations  are  1) 
performing  a  task  at  a  certain  location,  2)  obtaining  required  resources  and  knowledge  from  a  cer¬ 
tain  location,  3)  recovering  a  removed  agents’  social  contacts,  knowledge  and  resources,  4)  facili¬ 
tating  the  element  delivery  by  co-locating  with  the  interaction  partner. 


Function  Geospatial_relocation(int  agentID,  Random  r) 

requiredelements  =  getRequiredElements_consider_agent_task_assignment(agentID); 
visibleareas  =  getSphereOflnfluence(agentID,  vision  range  social  link  away 

,  return  only  location); 

choice  =  weightedRandomChoice(r,  weight_performing_task_at_location 
,  weight  obtaining  required  elements 

,  weight  recovering  removed  agents  contact,  weight  facilitating  delivery); 


Placerelocate  =  null; 
switch(choice) 

case  Performing  task  at  location: 

locationlist  =  fmdLocationsAttachedToAssginedTasks(agentlD); 
location  =  randomly_pick_one_location(r,  location  list); 
unLink(agentID,  agentID’ s  current  location); 

Link(agentID,  location); 
case  Obtaining  required  elements: 

locationlist  =  visibleareas; 

location  =  findlocationwithmostrequired 


resources_and_knowledge(location_list); 


If  ( pathage  !=  0  ) 

path  =  previously_calculated_path; 
path  age  =  path  age  -  1 ; 

Else 


path  =  getShortestPasth(agentID’s  current  location 

,  location,  only  using  location); 
path  age  =  path’s  decay  parameter; 

End; 


movelocation  =  path.firstlnThePath; 
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unLink(agentID,  agentID’s  current  location); 

Link(agentID,  move  location); 
case  Recovering  removed  agents  contacts: 
locationlist  =  visibleareas; 

location_list2  =  find_location_with_removed_agents(location_list); 
location  =  randomly_pick_one_location(r,  location_list2); 
unLink  (agentID,  agentID’s  current  location); 

Link(agentID,  location); 
case  Facilitating  element  delivery: 

locationlist  =  visiableareas; 
location  =  findlocationwithmost 

_agent_type_neighbors_in_social_network(location_list); 
unlink(agentID,  agentID’s  current  location); 

Link(agentID,  location); 

End  switch; 

obtainable  nodes  =  getObtainableResourceOrKnowledgeFromLocation(agentID’s  location); 
obtainablenode  =  randomly_pick_one_node(obtainable_nodes,  r); 
if  (  geospatial  gathering  threshold  <  r.nextValue ) 

Link(agentID,  obtainable  node); 

End  if; 

End  function; _ 


Code  8-3  Agent’s  geospatial  relocation  implementation  pseudo  code 


8.5.4.  Updated  task  execution  logic 


The  change  of  the  task  execution  logic  is  just  one  line  of  code.  Before  an  agent  tries  to  execute 
the  task,  the  agent  needs  to  check  whether  or  not  the  agent  is  on  the  site  for  the  task  execution. 
The  codes  reflecting  this  change  is  placed  right  after  the  task  requirement  checking  code. 


Function  Perform_task(int  agentID,  Random  r) 

task  list  =  getSphereOfInfluence(agentID,  one  social  link  away,  only  task  nodes); 
ready  task  list  =  select  only  ready  task  (task  list); 
ready_task_list2  =  select_tasks_with_agent_on_site(ready_task_list2); 
tasktoexecute  =  randomly_pick_one_task_that_all_required 

_elemets_are_gathered(ready_task_list2); 

If  ( taskExecutionSuccessRate  <  r.nextValue  ) 
recordTasklsDone(tasktoexecute); 

End; 

End  function; 


Code  8-4  Agent’s  task  execution  implementation  pseudo  code 


8.5.5.  Simulation  flow 


Figure  8-8  shows  which  simulation  flowchart  components  correspond  to  which  pseudo  codes  in 
the  previous  sections.  The  simulation  process  is  managed  by  the  simulation  model  main  loop. 
Code  7-1,  and  the  simulation  iteration  function,  Code  7-2.  In  the  simulation  iteration  function, 
each  agent  is  called  in  the  randomized  order,  and  the  agent  executes  three  aggregated  behavior 
patterns.  The  first  behavior  pattern  is  the  social  interaction  that  is  implemented  as  Agent’s  social 
interaction  implementation  pseudo  code  in  Code  8-2.  The  second  pattern  is  the  geospatial  reloca¬ 
tion  implemented  as  Agent’s  geospatial  relocation  implementation  pseudo  code  in  Code  8-3.  Fi- 
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nally,  the  third  pattern  is  the  task  execution  implemented  as  Agent’s  task  execution  implementa¬ 
tion  pseudo  code  in  Code  8-4. 


Implementation  is  covered 
Simulation  byCh.  8.5.1.  Updated  social 

Process  interactionjogics. 


Agent  Behavior 


Time 

N 


Agent  1  Behavior 


X 


Agent  2  Behavior 


X 


Agent  3  Behavior 


z 


X 


D 


Remove  agents  specified  in 
the  intervention  strategy  sequence 
(match  the  agent  ID  and  timing) 


X 


Implementation  is 
covered  by  Ch.  7.  4.1. 

Simulation  model 
iteration  management 


relocation 


Imple 


execution 


The  agent  take-over  the 
links  from  the  removed  agent 
to  resources,  expertise,  and  tasks 


Select  an  transferable  element  (expertise, 
resource  or  element  request)  and 
send  or  receive  the  selected  element 
to  or  from  the  partner  agent 


Implementation  is  covered 


by  Ch.  8.5 


3.  New  geospatial 


Exchange  transactive  memories  about 
each  other  agents 


OQICS 


Select  an  geospatial  location  to  relocate 


Select  one  regional  resources  and  expertise  to  acquire  the  selected  element 

mentation  is  covered  i 


:>  v  Ch.  8.5 


4.  Updated  task 


opics 


Find  a  ready  task  to  perform 


Perform  the  task  and  update  the  status  of  task  if  the  performance  was  successful 


Figure  8-8  Annotated  simulation  procedure  flow  chart.  The  annotation  specifies  which  items  in  the 
flow  chart  correspond  to  the  pseudo  code  in  Ch.  8.5. 

Table  8-9  is  the  list  of  key  parameters.  These  parameters  are  introduced  earlier  in  Ch  7.1.  and  Ch 
8.1.  However,  the  earlier  introductions  were  about  their  types  and  implications.  Table  8-9  pro¬ 
vides  the  links  between  the  pseudo  code  functions  and  the  used  parameters.  This  table  will  pro¬ 
vide  information  about  where  the  user  parameters  are  used  in  which  part  of  the  simulation  model. 


Table  8-9  Annotated  simulation  key  parameter  table 


Name  (Default  value  in 
the  parenthesis) 

Which  pseudo  code 
function  uses  the  pa¬ 
rameter 

Implication 

Probability  on  successful 
regional  resource  and  ex- 

Function  Geospa- 
tial  relocation  (Code  8- 

Probability  for  collecting  a  loca¬ 
tion-held  expertise  and  resources 
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Name  (Default  value  in 
the  parenthesis) 

Which  pseudo  code 
function  uses  the  pa¬ 
rameter 

Implication 

pertise  gathering  (0.5) 

3) 

by  an  agent. 

Change  timing  of  the 
geospatial  destination  (5) 

Function  Geospa¬ 
tial  relocation  (Code  8- 

3) 

When  an  agent  selects  a  place  to 
move,  he  will  cross  a  location-to- 
location  link  for  each  time-step.  In 
this  case,  the  agent  will  keep  his 
first  selected  location  as  a  destina¬ 
tion  for  the  number  of  time-step 
specified  by  this  parameter. 

Weights  for  task  perfor¬ 
mance  (0.70),  link  recov¬ 
ery  (0.10),  interaction  fa¬ 
cilitation  (0.10),  and  new 
resource/expertise  acqui¬ 
sition  (0.10) 

Function  Geospa¬ 
tial  relocation  (Code  8- 

3)  ' 

Weights  for  selecting  a  location  to 
move.  An  agent  selects  one  relo¬ 
cation  purpose  out  of  four.  An 
agent  may  move  to  a  location  to 
execute  a  task  to  be  done  at  a  spe¬ 
cific  location.  An  agent  may  move 
to  the  interaction  partner’s  loca¬ 
tion  to  facilitate  interactions.  An 
agent  may  move  to  the  removed 
agent’s  location  to  recover  the 
agent’s  links.  An  agent  may  move 
to  new  locations  to  acquire  needed 
resources  and  expertise. 

8.6.  Conclusion 


This  geospatial  extension  needs  further  information  than  usually  analysts  have.  However,  from 
the  further  information,  we  can  see  more  detailed  expected  behavior  of  adversaries  in  the  social 
and  geospatial  dimensions.  Particularly,  this  extension  enables  new  analysis  results,  i.e.  the  level 
of  geospatial  segregation  of  agents  over-time,  and  this  extension  changes  the  previous  analysis 
results,  i.e.  newly  identified  key  players,  changed  standardized  coefficient  values  in  the  regression 
models,  etc. 

Limitations:  Analysts  often  have  limited  knowledge  about  the  geospatial  locations  of  terrorists, 
regional  resources,  and  expertise.  If  they  have  limited  information  about  the  required  components, 
they  may  obtain  only  limited  results  from  this  model.  For  example,  the  Tanzania  and  Kenya 
bombing  case  must  have  much  finer  and  detailed  logistics  over  the  course  of  incident  executions. 
However,  our  knowledge  about  the  group  is  limited,  so  that  the  only  transnational  level  simula¬ 
tion  was  possible.  Therefore,  the  movements  may  be  too  obvious  or  less  informative  than  the  lev¬ 
el  of  resolution  that  a  traffic  simulation  model  might  generate. 
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Theoretical  contribution:  Multi-agent  simulation  models  usually  have  dealt  with  a  single  di¬ 
mension  such  as  either  the  spatial  dimension  or  the  social  network  dimension.  However,  to  model 
the  real  world  in  detail,  we  need  to  combine  multiple  interaction  dimensions.  To  perfonn  such  a 
simulation,  we  need  to  see  the  correlation  between  two  or  more  dimensions  to  model,  which  mo¬ 
tivations  from  which  dimension  dominate  the  agent  intentions,  and  what  the  differences  are  be¬ 
tween  the  multiple  dimensions.  This  chapter  introduces  such  expansion  of  the  multi-agent  simula¬ 
tion  model.  Furthermore,  the  organization  theory  domain  has  not  intensively  incorporated  the 
geospatial  information  into  their  social  and  organizational  dimensions.  However,  military  and 
corporate  logistics,  globally  distributed  software  development,  global  terrorist  networks  have 
geospatial  components  in  their  model.  I  show  an  example  of  how  to  model  such  geospatially  dis¬ 
tributed  organizational  structures  with  an  agent  based  model. 


Technical  contribution:  To  visualize  this  specific  multi-dimensional  data,  I  had  developed  G1S 
system  in  ORA.  Also,  the  simulation  model,  JDynetSpatial,  considers  discrete  geospatial  links 
and  transport  networks  when  it  decides  the  agent  behavior.  The  combination  of  the  GIS  network 
visualize  and  the  mutli-agent  network  simulation  model  can  be  powerful  in  displaying  which 
agents  are  segregating  where  and  how  the  segregation  stretches  command  and  control  or  man¬ 
agement  relations  over  the  geospatial  regions. 


Empirical  contribution:  I  traced  the  agent  interaction  and  organizational  element  transfer  net¬ 
work  in  Ch.  7.  This  chapter  adds  the  geospatial  movements  of  the  simulated  agents.  When  the 
initial  training  and  education  happens,  the  agents  are  segregated  around  the  Somalia,  Pakistan, 
and  Afghanistan  regions  because  these  regions  are  linked  to  training  resources  and  regional  ex¬ 
pertise  (weapons  expertise  at  the  Somalia  training  base).  Afterwards,  the  agents  move  from  the 
above  regions  to  actual  mission  regions,  Tanzania  and  Kenya.  This  geospatial  segregation  pat¬ 
terns  were  not  discovered  by  using  the  social  only  model.  When  we  match  the  Gantt  chart  output 
to  the  geospatial  segregation  chart  in  Ch.  8.3.3,  we  can  observe  which  regions  are  critical  and 
when.  Also,  the  key  individual  lists  in  Ch.  8.3.4.  are  different  from  the  same  key  individual  list  in 
Ch.  7.3.4.  For  example,  this  extended  model  indicates  Ai  Owaii  is  more  important  than  the  esti¬ 
mation  from  the  social  only  model  in  the  betweenness  centrality  perspective  of  agent-to-agent 
organizational  element  transfer  networks  at  the  late  stage  of  simulations.  To  reduce  the  mission 
execution  speed,  the  social  only  model  suggests  that  removing  high  cognitive  demand  agents  is 
preferable.  On  the  other  hand,  the  social  and  geospatial  model  suggests  that  removing  high  degree 
centrality  agents  is  preferable. 

•  A  multi-agent  model  should  be  able  to  handle  multiple  interaction  spaces  at  the  same 
time.  The  introduced  agent  model  simulates  the  social  and  the  geospatial  co-evolutions 
over-time. 

•  A  successful  intervention  should  consider  the  geospatial  criticality,  the  task  execution 
timing,  as  well  as  the  agent  interaction  and  organizational  element  transfer  network. 

•  A  combination  of  the  GIS  network  visualize  and  the  geospatial  and  social  simulation 
mode!  has  a  power  in  displaying  which  agents  are  segregating  where  and  how  the  se- 
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g  re  gate  stretches  command  and  control  or  management  relationships  over  the  geospa¬ 
tial  regions. 

This  geospatial  extension  provides  the  snapshot  of  organizational  behavior  in  two  dimensions: 
social  and  geospatial  dimensions.  This  two  correlated  snapshots  provide  more  sense-making  pic¬ 
tures  what  would  be  our  expected  adversarial  behavior  when  their  organizational  structures  and 
behavior  model  is  assumed.  This  is  more  information  that  analysts  can  use  over  the  course  of 
building  the  destabilization  strategies. 
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9.  Case  Study  -  How  To  Use  the  Integrated  Analysis  Framework  to  Analyze  the 
Terrorist  Organization  Responsible  for  the  U.S.  Embassy  Bombing  Incidents  in 

Kenya  and  Tanzania 

Human  analysts  need  to  use  an  integrated  destabilization  analysis  tools  to  grasp  a  more  complete 
picture  of  a  target  organization.  If  they  use  just  a  single  approach,  they  may  be  biases  by  the  used 
approach  because  they  will  not  have  results  generated  by  the  other  approaches.  Also,  one  analysis 
result  might  be  an  informative  input  to  other  analysis  approaches  by  significantly  reducing  the 
input  generation  for  analyses.  In  such  a  case,  this  seamless  interoperation  may  enhance  the  final 
analysis  results  and  improve  the  human  analysts’  efficiency.  However,  analysts  need  to  know 
which  analysis  approach  they  can  usually  start  with  and  how  to  cycle  the  analysis  result  with  the 
other  integrated  approaches. 


This  chapter  summarizes  the  analysis  procedure  of  this  integrated  framework.  When  a  human 
analyst  utilizes  this  framework  for  the  destabilization  analysis  of  an  observed  organization,  the 
analyst  needs  to  check  whether  or  not  the  dataset  is  usable  with  adequate  inputs.  Afterwards,  the 
analyst  runs  the  framework  and  generates  the  series  of  destabilization  analysis  results.  Moreover, 
when  the  final  simulation  analysis  is  over,  the  analyst  can  feed  the  simulation  results  back  to  the 
decision  making  structure  analysis  and  influence  network  analysis. 


Since  this  is  a  computational  procedure  using  various  inference  and  simulation  tools,  we  need  to 
consider  the  computational  resource  required  to  perform  this  analysis  procedure.  For  example,  the 
computation  cost  of  evaluating  an  influence  network  with  the  CAST  logic  grows  exponentially. 
Therefore,  I  provide  the  computational  cost  estimation  of  each  procedure  in  Appendix  Ch.  1 1 . 
With  this  estimation,  human  analysts  can  get  a  clue  about  which  procedure  will  take  how  much 
time. 


9.1.  Summary  of  the  Integrated  Framework  Usage 


The  introduced  analysis  framework  is  a  set  of  interoperable  destabilization  analysis  modules 
ranging  from  the  static  decision  making  structure  analysis  to  the  dynamic  multi-agent  simulation 
analysis  (See  Figure  9-1  .  Each  of  the  modules  is  interoperable,  and  some  of  the  results  can  be  fed 
back  to  the  previous  or  next  analysis  modules.  For  example,  the  arrows,  from  the  decision  making 
structure  to  the  meta  network  and  from  the  evolved  meta  network  to  the  meta  network,  represent 
that  the  produced  analysis  results  can  be  used  again  for  other  analysis  inputs. 


As  well  as  such  internal  interoperations,  the  framework  supports  the  interoperation  with  the  exist¬ 
ing  intelligence  analyst’s  tools,  i.e.  Caesar  III,  Pythia,  and  ArcGIS.  so  the  analysts  can  use  both 
the  introduced  framework  and  their  familiar  tools  at  the  same  time. 


CMU  SCS  ISR 


-170- 


CASOS  Report 


One  fundamental  feature  of  this  framework  is  the  emphasis  on  human  analysts’  inputs.  The  hu¬ 
man  analysts  play  an  important  role  in  this  analysis  procedure  by  providing  various  analysis  pa¬ 
rameters.  This  is  the  reuse  of  their  qualitative  and  subject-matter  related  expertise,  which  a  ma¬ 
chine  cannot  imitate  with  this  current  technology.  Also,  the  outputs  of  the  analysis  framework 
require  the  interpretation  from  the  human  analysts  for  final  course  of  action  recommendations 
while  the  outputs  provide  various  refined  estimations  for  such  human  analysts’  conclusions. 


CMU  SCS  ISR 


-171- 


CASOS  Report 


Input  For 

i  i 

Analysis 


Integrated 

Framework 


Destabilization 
Analysis  Results 


Further 

I 

Analysis 


Figure  9-1  The  system  architecture  of  the  introduced  analysis  framework 
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Figure  9-2  A  work  flow  chart  describing  a  suggested  analysis  procedure 


-173- 


CASOS  Report 


CMU  SCS  ISR 


Additionally ,  Figure  9-2  describes  a  suggested  analysis  procedure  using  the  integrated  framework 


Figure  9-1  is  the  system  architecture  of  the  implemented  framework).  A  human  analyst  may  start 


using  the  implemented  framework  by  loading  a  meta-network  in  ORA.  After  loading,  the  analyst 
can  1)  extract  a  decision  making  structure,  2)  generate  an  influence  network,  and  3)  simulate  the 
organizational  behavior.  Every  component  generates  an  estimated  network  fonnat  which  can  be 
loaded  in  ORA  again.  The  analyst  may  choose  to  run  the  same  analysis  procedure  with  the  esti¬ 
mated  network  structure  again. 


9.2.  Checking  the  Dataset  Requirement 


1  have  used  the  1998  U.S.  Embassy  Bombing  Incidents  in  Kenya  and  Tanzania  (See  Ch.  4.2.  for 
detailed  introduction)  to  describe  the  detailed  analysis  components.  I  will  use  the  same  dataset  to 
summarize  the  analysis  procedure  of  the  framework.  For  readers,  I  repeat  the  basic  statistics  of 


the  dataset  id  Table  9-1 


Table  9-1  the  overall  structure  of  the  1998  US  Embassy  Bombing  in  Tanzania  and  Kenya  dataset. 


Agent 

Expertise 

Location 

Resource 

Task 

Agent 

( 1 8  terror¬ 
ists) 

(Agent-to- 

Agent) 

0.143 

(Agent-to- 

Expertise) 

0.126 

(Agent-to- 

Location) 

0.200 

(Agent-to- 

Resource) 

0.076 

(Agent-to- 

Task) 

0.142 

Expertise 

(14  exper¬ 
tise) 

(Expertise-to- 

Expertise) 

Doesn’t  exist 

(Expertise-to- 

Location) 

0.071 

(Expertise-to- 

Resource) 

Doesn’t  exist 

(Expertise-to- 

Task) 

0.171 

Location 

(5  loca¬ 

tions) 

(Location-to- 

Location) 

0.500 

(Resource-to- 

Location) 

0.107 

(Task-To- 

Location) 

0.312 

Resource 

(13  re¬ 

sources) 

(Resource-to- 

Resource) 

Doesn’t  Exist 

(Resource-to- 

Task) 

0.120 

Task 

(25  tasks) 

(Task-to- 

Task) 

0.055 

The  main  dataset  for  this  framework  is  a  DynetML  fde  containing  a  meta  network.  The  meta 
network  is  a  multi-modal  and  multi-plex  social  network  that  can  represent  a  complex  organiza¬ 
tional  structure  (see  Ch.  4.1).  Since  the  meta  network  concept  contains  different  types  of  nodes 
and  links, [ 


Table  9-2 


specifies  which  types  of  nodes  and  links  are  required  to  perform  which  anal- 
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ysis  component.  A  human  analyst  can  choose  the  extent  of  framework  usage  based  on  the  dataset 
that  the  analyst  has. 


Table  9-2  the  check  list  to  perforin  an  analysis  component,  Required  means  that  the  dataset  must 
have  the  input  component  (even  it  is  the  blank,  it  should  specify  the  blank),  Optional  means  that  the 
analysis  will  take  the  input  into  the  consideration,  but  not  mandatorily  required,  Don’t  Care  means 
that  the  input  component  will  not  be  used  in  the  analysis  component. 


Nodes  and 

Links 

Decision  Mak¬ 

Influence  Net¬ 

Multi-Agent  Si¬ 

Multi-Agent  Simula¬ 

ing  Structure 
Analysis 

work  Structure 
Analysis 

mulation  of  Social 
Only  Model 

tion  of  Social  and 
Geospatial  Model 

Agent 

Required 

Required 

Required 

Required 

Resource 

Optional 

Required 

Required 

Required 

Expertise 

Optional 

Required 

Required 

Required 

Task 

Required 

Required 

Required 

Required 

Location 

Doesn’t  Use 

Doesn’t  Use 

Doesn’t  Use 

Required 

Agent-to- 

Agent 

Required 

Doesn’t  Use 

Required 

Required 

Agent-to- 

Resource 

Optional 

Required 

Required 

Required 

Agent-to- 

Expertise 

Optional 

Required 

Required 

Required 

Agent-to- 

Task 

Required 

Required 

Required 

Required 

Agent-to- 

Location 

Doesn’t  Use 

Doesn’t  Use 

Doesn’t  Use 

Required 

Resource- 

to-Task 

Optional 

Required 

Required 

Required 

Resource- 

to-Location 

Doesn’t  Use 

Doesn’t  Use 

Doesn’t  Use 

Required 

Expertise- 

to-Task 

Optional 

Required 

Required 

Required 

Expertise- 

to-Location 

Doesn’t  Use 

Doesn’t  Use 

Doesn’t  Use 

Required 

Task-to- 

Task 

Required 

Required 

Required 

Required 

Task-to- 

Location 

Doesn’t  Use 

Doesn’t  Use 

Doesn’t  Use 

Required 

Location-to- 

Location 

Doesn’t  Use 

Doesn’t  Use 

Doesn’t  Use 

Required 

Additionally,  the  analyst  wants  to  check  the  validity  of  the  dataset.  In  many  cases,  the  observation 
of  the  adversarial  organizations  is  noisy  and  uncertain.  Therefore,  some  input  components,  such 
as  agent-to-agent,  may  have  false  information.  However,  most  of  the  input  components  can  be 
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verify  by  humans  and  existing  databases  to  some  extent.  For  example,  the  task-to-task  network, 
or  task  dependency  network,  can  be  modified  by  an  analyst  if  the  analyst  understands  the  proce¬ 
dure  of  terror  activities  in  detail.  Also,  there  are  known  associations  among  agents  in  databases  as 
well  as  their  expertise  and  available  resources,  such  as  whether  Bin  Laden  is  rich  (has  the  money 
resource)  or  not.  These  are  all  external  supports  to  build  up  the  appropriate  analysis  dataset,  and 
the  analyst  may  or  may  not  use  those  external  supports  in  the  dataset  preparation. 


There  are  adjunct  inputs  for  the  analysis  components.  These  inputs  are  parameters  for  analyses.  If 
an  analyst  has  a  input  meta  network  in  his  hand,  most  of  these  parameters  should  be  available  to 
the  analyst.  For  example,  the  interaction  partner  decision  radius  should  be  available  when  the  ana¬ 
lyst  has  the  agent-to-agent  network.  Or,  the  analyst  has  his  own  views  toward  the  operation  of  the 
adversaries.  Then,  his  expert  views  determine  the  parameters.  Or,  there  are  analysis  or  report  re¬ 
quirements  that  the  analyst  has  to  follow,  i.e.  the  possibility  of  successful  detonation  task  execu¬ 
tion.  Then,  these  requirements  set  the  parameters! 


Table  9-3 


specifies  such  parameters. 


Table  9-3  Required  parameters  for  analysis  components 


Decision  Mak¬ 
ing  Structure 
Analysis 

Selection  of  Task 
of  Interest 


Influence  Network  Struc¬ 
ture  Analysis 

Selection  of  Task  of  Inter¬ 
est 

Parameters  for  the  Organi¬ 
zational  Assessment  Heu¬ 
ristics 

Parameters  for  the  Assess¬ 
ment  Marginal  Probability 
Assignments 


Multi-Agent  Simu-  Multi-Agent  Simula- 
lation  of  Social  On-  tion  of  Social  and 
ly  Model  Geospatial  Model 

Agent  Removal  Agent  Removal  Scena- 
Scenarios  rios 


Parameters  Specified 


in  Table  7-1 


Parameters  Specified  in 

Table  7-1 1 


Parameters  Specified  in 
Table  8-1 1 


After  gathering  the  meta-network  and  required  parameters  for  analysis  components,  the  analyst 
can  utilize  the  integrated  framework  to  the  extent  that  he  wants  the  results  and  the  dataset  sup¬ 
ports. 

9.3.  Destabilization  analysis  procedure 

After  checking  the  dataset  requirement  and  human  analysts’  parameter  settings,  the  analysts  start 
the  destabilization  analysis.  Below  sub-sections  are  in  the  order  of  suggested  analysis  procedure. 

9.3.1.  Step  1:  Decision  making  structure  analysis 

The  first  analysis  component  is  the  decision  making  structure  analysis.  This  is  likely  to  be  the 
first  analysis  that  the  analyst  may  perform  because  1 )  the  analyst  might  want  to  know  the  embed¬ 
ded  command  and  control  relationships  among  agents,  2)  the  analyst  might  want  to  limit  the 
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scope  of  the  meta  network  by  removing  unrelated  tasks  and  agents,  3)  the  analyst  might  want  to 
use  only  the  significant  social  relations  in  the  further  investigation. 

Analysis  objBCtiVB:  The  objective  of  this  analysis  step  is  identifying  the  critical  decision  making 
structure  from  an  observed  social  network.  The  observed  social  network  does  not  guarantee  that 
every  relation  among  agents  is  significant  and  critical,  particularly  from  the  mission  or  task  com¬ 
pletion  perspective.  Therefore,  throughout  this  analysis  step,  a  human  analyst  aims  to  drill  down 
and  reason  possible  embedded  decision  making  structure  which  only  contains  significant  social 
relations  from  the  organization’s  operation  viewpoint. 


Analysis  r es U Its :  Outputs  of  this  analysis  are  the  extracted  decision  making  structures 
represented  as  three  distinct  social  networks,  information  sharing,  result  sharing  and  command 
interpretation.  These  networks  are  different  from  the  original  agent-to-agent  social  network.  Ad¬ 
ditionally,  the  technical  implementation  allows  the  generation  of  input  files  for  Caesar  III,  which 
is  an  cognitive  decision  making  process  analysis  program.  Extracting  three  further  social  net¬ 
works  means  that  the  analyst  has  three  more  key  individual  lists  from  the  perspective  of  each  de¬ 
cision  making  structure.  Therefore,  the  final  outputs  of  this  analysis  component  will  be  1)  new 
meta-matrixes  with  three  new  social  networks  (See  Figure  5-10  ,  2)  an  input  to  decision  making 


cognitive  procedure  analysis  program,  and  3)  new  key  personnel  lists  (See 


Table  5-4 


E m pi rical  key  lessons  learned:  This  particular  application  results  found  that  some  key  actors 
who  are  over-  or  under-estimated  before.  For  example,  Anas  at~L  iby  was  the  task  coordinator  who 
has  higher  network  metrics  in  the  result  sharing  g  structure  than  in  the  original  structure.  Addi¬ 
tionally,  A  /  Owali  is  a  newly  found  critical  actor  in  the  information  sharing  (the  second  in  the  de¬ 
gree  centrality,  the  first  in  the  betweenness  centrality,  the  second  in  the  eigenvector  centrality, 
and  the  second  in  the  cognitive  demand).  Additionally,  actor  profiling  is  done.  The  profile  reveals 
four  actor  clusters  from  the  observed  network  and  four  other  clusters  from  the  extracted  network. 
For  example,  Fahid  Mohammed  Ally  M sal  am  and  Azzam  are  identified  as  actors  with  few  links  to 
other  personnel  and  medium  communication  demand  to  complete  their  tasks. 


Feedback  to  the  analysis  framework:  Among  these  outputs,  the  new  meta  network  can  be  used 
in  the  subsequent  analyses.  Or,  the  original  meta  network  can  be  used  consistently.  This  depends 
on  the  intent  of  the  analyst  used  this  decision  making  structure  analysis. 

9.3.2.  Step  2:  Influence  network  analysis 

The  next  component  that  the  analyst  might  be  interested  in  is  the  influence  network  analysis.  The 
analyst  may  perform  this  analysis  because  1)  the  analyst  might  wants  to  know  well  or  poorly  sup¬ 
ported  tasks  of  the  adversarial  organization,  2)  the  analyst  might  wants  to  know  what  are  the 
tasks’  important  factors,  i.e.  personnel  assignment,  resource  availability,  task  complexity,  etc,  3) 
the  analyst  might  wants  to  know  the  level  of  task  execution  likelihood  of  the  adversaries,  so  that 
he  can  evaluate  whether  the  adversaries’  mission  can  be  carried  out  or  not  under  the  given  cir¬ 
cumstances. 
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Analysis  objectiVB:  Human  analysts  aim  to  find  out  the  organizational  supports  for  tasks  of  ad¬ 
versaries.  With  a  snapshot  of  a  meta-network,  the  analysts  cannot  intuitively  distinguish  well-  or 
ill-supported  tasks  of  the  organizations.  As  well  as  the  organizational  support  assessment,  the 
analysts  need  to  see  the  bottleneck  tasks  that  hinder  or  promote  subsequent  tasks.  However,  these 
assessments  should  consider  different  viewpoints  regarding  the  hostility/easiness  of  operational 
environment  or  the  difficulties  of  tasks.  This  consideration  can  be  done  by  adding  a  sensitivity 
analysis  to  the  influence  network  generation  and  evaluation  phases. 


Analysis  results:  Outputs  of  this  analysis  are  the  generated  influence  network  and  the  evaluation 
under  various  parameters  that  reflect  the  analysts’  perspective.  The  generated  influence  network 
is  the  input  file  for  Pythia,  which  is  an  influence  network  analysis  program.  The  generated  influ¬ 
ence  network  shows  the  marginal  probabilities  that  are  determined  by  the  assessment  of  organiza¬ 
tional  supports  and  task  inherent  difficulties  and  importance.  The  assessment  is  done  by  using  the 
analyst’s  selected  parameters.  The  marginal  probabilities  of  tasks  are  the  task  completion  likelih¬ 
oods.  Examination  on  these  marginal  probabilities  will  suggest  tasks  of  interests  and  tasks’  fac¬ 
tors  of  interests.  For  example,  Figure  6-6  shows  the  generated  influence  network.  Figure  6-7  and 


Table  6-3 


shows  the  completion  likelihood  of  each  task. 

and 


parameters  for  the  analysts’  selection. 


Table  6-6 


Table  6-4 


Table  6-7 


and  Table  6-5 


are  the  optional 
are  the  completion  likelihood 
changes  under  various  analysts’  perspectives.  From|  Figure  6-7|and  Table  6-3,  the  analyst  can  pick 
the  task  of  interest  based  on  their  well  or  poor  organizational  supports. 


Empirical  key  lessons  learned:  The  analysis  result  identifies  tasks  that  have  low  completion  li¬ 
kelihood,  such  as  conceal  bomb  In  car  and  provide  money,  because  the  tasks  are  under-supported 
by  the  organization.  In  contrast,  review  surveillance  files,  film  videotape  announcing  martyrdom, 
and  surveillance  Of  possible  targets  show  high  task  completion  likelihood  indicating  good  organi¬ 
zational  supports  from  adversaries.  As  the  operational  environment  setting  changes,  overall  plan¬ 
ning  and  execution  and  bomb  preparation  shows  big  changes  in  the  completion  likelihood  which 
means  that  we  can  drop  the  completion  likelihood  hugely  if  we  are  able  to  change  the  operation 
environment  of  adversaries. 

Feedback  to  the  analysis  framework:  This  analysis  suggests  tasks  of  interest  based  on  the  orga¬ 
nizational  support  for  tasks.  The  tasks  of  interest  can  be  analyzed  again  by  the  previous  decision 
making  structure  analysis. 

9.3.3.  Step  3:  Multi-agent  simulation  of  social  only  model 

After  static  analysis  on  the  decision  making  structure  and  evaluation  on  task  completion  likelih¬ 
oods,  the  analyst  may  want  to  project  what  will  happen  if  the  analyst  strategize  the  removals  of 
terrorists.  Particularly,  the  analyst  may  want  1)  to  see  the  impact  of  the  removals  and  whether  the 
impact  is  negative  or  not,  2)  to  see  the  social  interactions  and  organizational  element  transfers, 
and  3)  to  estimate  the  timeline  of  the  adversaries’  mission. 
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Analysis  objective:  Human  analysts  aim  to  simulate  the  adversaries’  social  interactions,  such  as 
resource  and  expertise  transfer  through  interactions.  This  simulation  considers  only  the  social  di¬ 
mension  of  the  target  adversarial  organization.  From  this  simulation,  the  analysts  will  figure  out 
1 )  how  long  the  mission  execution  would  take,  2)  what  the  estimated  social  behavior  of  adversa¬ 
ries  would  be,  and  3)  what  the  impact  of  agent  removals  (strategic  interventions)  would  be.  If  the 
adversarial  organization  is  not  ready  to  execute  the  mission  with  only  social  behavior,  this  simu¬ 
lation  will  identify  the  lack  of  required  expertise  and  resources  which  are  not  acquired  by  adver¬ 
saries,  yet. 


Analysis  r es U I tS :  Outputs  of  this  analysis  are  the  estimated  meta  network  from  the  interaction 
and  transfer  perspectives,  the  organizational  performance  metric  values,  the  estimated  mission 
completion  speed,  and  the  estimated  Gantt  chart.  The  estimated  meta  network  is  generated  by 
recording  the  interactions  and  organizational  element  transfers  among  agents  (see  Table  7-6  .  Ad¬ 


ditionally,  if  some  agents  are  removed  over  the  course  of  simulations,  the  recovered  organization¬ 
al  structure  also  can  be  obtained.  To  evaluate  the  impact  of  interventions,  the  organizational  per¬ 
formance  metrics  are  used.  The  performance  metrics  cover  how  much  the  expertise  is  spread  and 


how  well  the  resources  and  expertise  are  distributed  for  correct  task  executions  (see  Figure  7-5 


Also,  the  mission  completion  speeds  are  calculated  by  observing  when  the  task  dependency  net¬ 
work  is  completed  (see  Figure  7-6  and  Figure  7-7  .  Finally,  the  mission  execution  status  is 


represented  by  using  an  estimated  Gantt  chart  (see 


Figure  7-8 


Empirical  key  lessons  learned:  Simulation  with  the  social  only  model  shows  that  removing 
higher  degree  agents  in  large  number  at  the  early  stage  would  be  effective.  However,  this  may  not 
be  achievable  in  the  real  world.  The  simulation  analysis  identified  bottleneck  tasks  such  as  the 
rent  residence  task  that  has  the  longest  execution  time  across  the  tasks  during  the  mission.  The 
simulations  identified  the  organizational  element  transfer  networks  among  agents.  There  are 
agents,  i.e.  Fazul  Abdullah  Mohammed,  Al  Owa/i  and  Wadih  el-Hage,  who  consistently  appear  in 
the  transfer  network  over-time. 

Feedback  to  the  analysis  framework:  This  simulation  approach  generates  the  estimated  organi¬ 
zational  structures  after  removals.  Also,  the  simulation  records  the  estimated  interaction  and  or¬ 
ganizational  elements  transfer  networks.  These  are  the  new  estimated  organizational  structures  in 
the  meta  network  format.  Therefore,  the  structures  can  be  fed  back  to  the  decision  making  struc¬ 
ture  analysis  and  the  influence  network  analysis,  so  that  the  two  analyses  can  generate  the  esti¬ 
mated  task  completion  likelihoods  of  future  or  decision  making  structure  after  removal. 

9.3.4.  Step  4:  Multi-agent  simulation  of  social  and  geospatial  model 

In  contrast  to  the  social  only  model,  the  social  and  geospatial  model  can  answer  the  analyst’s 
geospatial  related  questions.  For  example,  if  the  adversarial  organizations  are  spread  across  re¬ 
gions  and  if  the  adversaries  exhibit  transnational  movements,  the  analysts  may  want  1 )  to  esti¬ 
mate  the  level  of  adversaries’  segregation  of  a  specific  place,  2)  to  estimate  the  importance  of 
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transnational  movement  passages,  or  3)  to  estimate  the  transnational  social  and  decision  making 
structures  that  connects  two  regions. 


Analysis  0  b  j  ecti  ve :  Human  analysts  aim  to  simulate  the  social  and  geospatial  movements  of  ad¬ 
versaries.  The  analysts  need  to  know  1)  where  the  adversaries  will  segregate  and  when;  2)  how 
the  social  behavior  will  change  if  adversaries  are  able  to  make  transnational  movements;  and  3) 
how  the  intervention  effects  will  be  different  when  we  consider  geospatial  effects.  To  answer 
these  questions,  the  analysts  will  observe  the  simulation  considering  the  social  and  geospatial  co¬ 
evolution  with  a  multi-agent  simulation. 


Analysis  resu  Its:  Outputs  of  this  analysis  include  all  the  outputs  of  the  multi-agent  simulation  of 
social  only  model.  On  top  of  the  social  only  model  outputs,  the  social  and  geospatial  model  gene¬ 
rates  the  estimated  segregation  of  the  agents  across  regions,  the  weighted  transnational  passage 
networks,  and  the  visualization  of  the  social  and  decision  making  structure  over  the  geospatial 
map.  The  estimated  agent  segregation  across  regions  (see  Figure  8-7  indicates  how  many  agents 
are  where  and  when.  For  instance,  some  of  agents  will  segregate  in  Somalia  and  Afghanistan  be¬ 
cause  they  can  gain  regional  expertise  and  resources  by  being  there.  However,  after  the  early 
stage  of  the  mission,  they  will  move  from  the  training  sites  to  the  mission  execution  sites  such  as 
Tanzania  and  Kenya.  Additionally,  when  agents  move  to  other  locations,  they  use  the  location-to- 
location  passage  networks.  Therefore,  1  show  the  criticality  of  the  location-to-location  links  by 
counting  the  number  of  passage  uses  (Seel" 


Table  8-6 


.  Finally,  I  visualize  the  geospatial  distribu¬ 
tions  of  adversaries  and  their  social  and  decision  making  structures  over  a  geospatial  map  (See 


Table  8-6 


Empirical  key  lessons  learned:  The  social  and  geospatial  model  simulation  suggests  that  the 
agents  are  segregated  around  the  Somalia,  Pakistan,  and  Afghanistan  regions  when  the  initial 
training  and  education  happens  because  these  regions  are  linked  to  training  resources  and  regional 
expertise  (weapons  expertise  at  the  Somalia  training  base).  Afterwards,  the  agents  move  from  the 
above  regions  to  actual  mission  regions,  Tanzania  and  Kenya.  The  identified  key  individual  lists 
are  partly  different  from  the  list  of  the  social  only  model.  The  extended  model  indicates  Ai  Owaii 
is  more  important  than  the  estimation  from  the  social  only  model  in  the  betweenness  centrality 
perspective  of  agent-to-agent  organizational  element  transfer  networks. 


Feedback  to  the  analysis  framework:  This  simulation  approach  generates  the  estimated  organi¬ 
zational  structures  after  removals  just  like  the  previous  simulation  model.  Hence,  the  feedback  is 
the  same:  the  newly  generates  meta  network  can  be  fed  to  the  decision  making  and  influence  net¬ 
work  analyses.  On  the  other  hand,  the  generated  geospatial  visualizations  can  be  loaded  in  Arc- 
GIS  for  further  geospatial  analyses.  The  transformation  of  visualization  to  ArcGIS  can  be  done  by 
using  ORA. 

9.4.  Summary  of  key  lessons  learned 
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Human  analysts  are  interested  in  1)  who  hidden  key  actors  are  in  their  decision  making  structure, 
2)  which  tasks  are  likely  done  and  well  supported  by  the  adversaries,  3)  whose  removals  would 
disrupt  their  mission  execution  greatly,  4)  geospatially  where  they  are  and  are  heading  toward  at  a 
particular  stage.  The  above  questions  are  answered  by  the  integrated  analysis  components. 

After  running  the  decision  making  structure  analysis  with  the  observed  meta  network,  human  ana¬ 
lysts  find  out  that  the  observed  network  over-  or  under-estimate  some  terrorists  in  the  convention¬ 
al  network  analysis.  By  considering  the  expected  information  sharing,  result  sharing,  and  com¬ 
mand  interpretation  activities  of  the  adversaries,  Anas  al-Libyis  identified  as  the  task  coordinator 
with  the  high  betweenness  centrality  in  the  result  sharing  structure.  A I  Owati  is  a  newly  found 
important  actors  in  the  information  sharing  structure.  Furthermore,  the  observed  network  and  the 
extracted  decision  making  structure  produced  actor  profiles.  For  example,  Fahid  Mohammed  Ally 
Msalam  and  Azzam  are  the  actors  who  are  not  well  connected,  but  need  communications  with 
others  to  complete  their  tasks. 

While  the  above  answers  who  hidden  key  actors  are,  the  human  analysts  need  to  know  the  level 
of  adversarial  organization’s  support  to  each  of  tasks  in  their  mission.  The  influence  network 
analysis  with  the  observed  meta  network  suggests  that  provide  money  and  conceal  bomb  In  car 
are  the  tasks  not  well  supported.  On  the  other  hand,  review  surveillance  files  is  a  well  supported 
task.  The  human  analysts  have  to  make  a  recommendation  disrupting  the  organizational  supports 
to  either  well-  or  ill-supported  tasks.  If  they  tackle  well-supported  tasks,  they  are  aiming  to  lower 
the  overall  task  completion  likelihood  of  the  task  network  for  the  adversaries’  mission.  If  they 
attack  ill-supported  tasks,  they  are  trying  to  break  the  middle  of  the  task  network  for  the  mission. 

Whereas  above  assessments  are  static  and  macro  level,  some  human  analysts  want  to  estimate  the 
individual  terrorist  behavior  and  the  collective  organizational  behavior.  Furthermore,  they  want  to 
assess  the  impact  of  removing  some  terrorists  over  the  course  of  their  mission  execution.  The  si¬ 
mulation  model  about  their  social  behavior  indicates  that  removing  high  degree  terrorists  in  the 
large  number  at  the  earlier  stage  would  decrease  the  mission  execution  time  a  lot.  The  model  also 
found  that  rent  residence  is  a  bottleneck  task  of  the  adversarial  mission  execution.  Some  terrorists, 
such  as  Wadih  el-Hage,  Al  Owali,  and  Fazui  Abdullah  Mohammed,  are  estimated  to  act  like  the 
resource  and  information  broker  during  their  mission  execution. 

Finally,  the  human  analysts  want  to  know  where  the  terrorists  would  be  at  a  particular  mission 
stage.  The  estimated  Gant  chart  and  the  estimated  geospatial  agent  segregation  level  suggests  that 
there  will  be  terrorist  segregation  in  Somalia,  Pakistan,  and  Afghanistan  at  the  early  stage  of  mis¬ 
sion.  However,  such  segregation  will  move  to  Tanzania  and  Kenya  after  the  terrorists  finish  the 
training.  The  Gant  chart  tells  the  time  portion  of  the  training  over  the  course  of  mission  execution 
time. 

The  interpretation  of  the  produced  results  can  be  basis  for  the  human  analysts’  destabilization 
analysis  report.  However,  it  should  be  noted  that  the  results  are  only  the  numeric  representation  of 
the  estimated  situation.  The  human  analysts  need  to  include  and  apply  their  expertise  in  the 
process  of  interpreting  these  computational  analysis  results.  With  their  subject  knowledge  and 
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estimated  computational  analysis,  the  analysts  will  have  a  report  displaying  quantitative  and  joint 
picture  of  adversaries’  situation  and  weaknesses. 

9.5.  Possible  model  validation  method 

Among  many  possible  extensions  of  this  work,  I  want  to  point  out  two  validation  directions:  ap¬ 
plying  the  introduced  analysis  method  to  an  industrial  situation  and  validating  the  method  with 
real-world  data.  These  two  research  directions  are,  in  fact,  complementary  to  each  other.  While  I 
develop  and  apply  this  work  to  the  adversarial  organization  analysis,  I  found  out  that  having 
complete  observations  about  the  situation  over-time  is  almost  impossible  in  the  given  context.  1 
had  to  rely  on  a  university  research  report  and  various  open  source  documents  to  come  up  with  a 
meta-network  and  a  qualitative  evaluation  of  the  application  result.  On  the  other  hand,  if  we  apply 
this  method  to  a  general  management  of  research  institute  or  industrial  organizations,  we  have  a 
better  chance  to  have  a  dataset  that  can  be  analyzed  with  this  tool  and  used  to  validate  this  tool. 

Thus,  I  suggest  that  the  first  step  to  expand  this  research  is  applying  this  framework  to  the  indus¬ 
trial  context.  Particularly,  we  need  to  collect  the  over-time  data  about  the  below  issues. 

•  Organizational  personnel  interactions:  Personnel  must  interact  with  each  other  to  com¬ 
plete  their  tasks  or  to  have  friendship  interactions.  The  decision  making  structure  infe¬ 
rence  in  this  work  is  partially  able  to  distinguish  such  nature  of  interactions.  However,  to 
validate  such  approaches,  we  need  to  have  more  complete  observations  without  biases,  i.e. 
recording  infonnation  sharing  activities,  but  not  reporting-back.  Also,  human  analysts 
may  need  to  annotate  the  nature  of  some  interactions,  so  that  they  can  be  used  to  test  the 
accuracy. 
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-  More  complete  meta-network 
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Optimization  on  analysis  parameters  to 
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Validation 

-  Statistical  correlation  analysis  between 
the  performance  estimations  on  the  future 
performance  predictions  from  the 
calibrated  model  and  the  actual 
performance  observation 


Figure  9-3  A  work  flow  for  the  possible  validation  method 


Model  Improvement 
-Better  observation 
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•  Project  requirements  and  assignments:  While  the  traditional  social  network  analysis  fo¬ 
cused  on  personnel  interactions,  this  approach  utilizes  the  dynamic  network  analysis  ap¬ 
proach  including  resources,  expertise,  tasks  as  well  as  personnel.  Therefore,  the  data  col¬ 
lection  should  cover  the  project-resource,  project-personnel,  and  project-expertise  rela¬ 
tionships.  This  extended  observation  will  allow  us  to  have  a  complete  meta-network  that 
we  need  to  run  this  approach. 

•  Project  progress:  Project  progress  over-time  need  to  be  captured.  One  contribution  of  my 
thesis  is  developing  a  multi-agent  model  that  estimate  the  project  progress  with  a  given 
organizational  structure.  With  the  above  observations  about  the  organizational  structure, 
we  have  a  detailed  input  deck  for  the  analysis.  Then,  we  need  to  have  the  observed 
project  progress,  so  that  we  can  compare  the  inferred  project  progress  from  my  analysis 
method  to  the  observed  project  progress. 

This  observation  will  provide  the  basic  input  deck  to  run  this  analysis  approach.  However,  the 
basic  input  deck  and  the  analysis  result  from  the  default  run  will  not  give  reliable  estimations 
without  calibration.  There  are  number  of  parameters  in  this  analysis  procedure.  For  example,  hu¬ 
man  analysts  have  to  set  the  influence  network  parameters  and  simulation  parameters.  These  can 
be  calibrated  by  using  the  organizational  structure  and  project  progress  observations.  For  example, 
with  the  early  period  of  organizational  structures  and  organizational  performance,  we  may  optim¬ 
ize  the  parameters  to  see  whether  the  analysis  approach  can  predict  the  late  period  organizational 
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performance.  This  described  procedure  is  illustrated  in  Figure  9-3 


1  believe  that  this  observation. 


calibration  and  validation  analysis  is  a  big  remaining  research  area  that  can  increase  the  trust  of 
this  analysis  framework. 
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10.  Conclusion 


This  chapter  summarizes  the  limitations  and  contributions  of  the  introduced  destabilization  analy¬ 
sis  framework.  The  introduced  framework  is  a  new  system  that  1)  provides  a  joint  picture  from 
multiple  disjoint  pictures  from  diverse  analysis  approaches;  2)  estimates  human  organization 
changes  with  partial  infonnation;  and  3)  incorporates  human  wisdom  in  the  process  of  computa¬ 
tional  analyses  of  complex  and  dynamic  problems.  Enabling  the  above  outcomes  requires  the  in¬ 
tegration  of  various  theories  from  sociology,  statistics,  management,  and  computer  science. 
Therefore,  major  contributions  are  made  in  providing  new  theoretical,  technical  grounds  to  com¬ 
plete  the  integration  of  different  theories  and  approaches.  However,  some  inherent  problems  still 
exist.  For  instance,  the  validation  of  estimation  results,  inferring  uncovered  data,  and  extensive 
use  of  computation  powers  might  be  the  limitations  of  this  work.  In  spite  of  these  limitations,  this 
work  partially  demonstrates,  with  incomplete  datasets,  ho  on  can  craft  a  fusion  of  computations 
and  organizations/management  science  to  solve  real  world  problems. 

10.1.  Limitations 

This  study  has  three  major  limitations.  First,  the  framework  requires  a  specific  dataset  that  may 
not  be  obtained  in  the  real  world  situations,  and  the  work  assumes  that  the  obtained  dataset  con¬ 
tains  only  trustful  data.  Second,  the  framework  generates  estimations  without  any  significant  va¬ 
lidations.  Third,  the  framework  consumes  extensive  computational  power,  particularly  during  the 
simulation  analysis,  so  there  is  a  limitation  in  the  analysis’  scalability. 

Dataset  requirement:  This  framework  needs  specific  inputs  from  analysts.  If  an  analyst  does  not 
have  such  observations,  they  would  have  to  guess  the  relationships  or  use  existing  databases. 
These  approximations  will  contribute  to  noisy  analysis  results.  The  required  datasets  are  listed  in 
Chapter  9. 1 ;  the  type  of  inputs  is  described  in  Chapter  4.1. 

Undone  validation:  This  framework  generates  estimations  that  are  not  validated.  The  analysis 
results  are  highly  speculative.  Sometimes  I  just  implemented  human  analysts’  biases.  This 
framework  does  not  intend  to  pursue  the  exact  discovery  of  the  relations  in  past  real  world  or  hid¬ 
den  organizations  (perhaps  the  introduced  analysis  can  be  an  approximation  of  such  hidden  rela¬ 
tions).  A  better  description  of  the  introduced  framework  is  the  computational  tool  performing 
human  analysts’  existing  analysis  approaches  in  a  more  robust  manner.  From  this  viewpoint,  this 
analytical  approach  is  different  from  the  data-mining  approach  that  wants  to  find  accurate  rela¬ 
tionships  in  the  data. 

Analysis  scalability12:  This  framework  is  limited  to  the  analysis  of  a  medium-sized  adversarial 
organization.  If  an  organization  is  a  more  of  a  sociological  entity  than  a  mission-  or  task-oriented 
organization,  the  organization  should  be  analyzed  using  more  sociological,  cultural,  and/or  belief 
analysis  methods.  This  approach  is  highly  linked  to  the  concept  of  task  and  mission  completion, 
which  limits  the  size  of  the  investigation.  According  to  the  scalability  results  in  Chapter  1 1 ,  this 


12 1  made  a  more  extensive  discussion  and  exploratory  analysis  about  the  analysis  scalability  in  Chapter  11. 
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approach  can  handle  more  than  500  agents  in  an  organization  (in  addition  to  the  number  of  agents, 
there  are  many  other  factors  in  deciding  whether  the  method  is  applicable  or  not).  Particularly,  the 
simulation  methods  require  a  long  time  to  perform  a  complete  analysis. 


10.2.  Getting  toward  more  nuanced  analysis  approaches 


This  study  has  attempted  to  put  key  aspects  of  adversarial  organizations  into  an  analysis  frame¬ 
work.  For  example,  it  has  combined  the  social  interactions  and  the  geospatial  relocations  to  pro¬ 
vide  an  improved  understanding  of  the  impact  of  strategic  interventions.  By  considering  more  key 
aspects  of  the  problem  domain,  richer  analyses  should  result.  Whether  the  results  are  more  accu¬ 
rate  when  more  key  aspects  are  considered  has  not  been  proven.  That  remains  for  future  research. 

Among  the  earlier  works  in  this  domain,  Farley  (2003)  modeled  the  al-Qaeda  organization  as  a 
pyramid-  or  tree-like  organizational  structure.  From  this  strict  hierarchical  structure,  he  computes 
a  set  of  nodes  lists  that  can  disturb  the  structure.  Though  this  work  is  a  good  attempt  to  formulize 
a  strategic  intervention,  his  model  vastly  over-simplified  the  al-Qaeda  structure  in  two  ways:  it 
assumed  the  structure  to  be  strictly  hierarchical  and  treated  it  as  temporarily  static.  More  detailed 
studies  that  are  closer  to  the  data  (Stern,  2003a;  McFate,  2005a;  Burke,  2004)  argue  that  the  al- 
Qaeda  structure  is  a  decentralized  network,  at  least  at  the  below-the -top-leadership  level.  Other 
empirical  studies  demonstrate  the  evolutionary  nature  of  the  adversarial  organizational  structure 
(Fulmer,  2000;  Goolsby,  2006).  A  model  of  al-Qaeda  that  allows  for  a  distributed  and  dynamic 
structure  would  be  more  nuanced,  closer  to  empirical  reality,  and  likely  to  generate  different  con¬ 
clusions  about  how  to  destabilize  al-Qaeda.  Indeed,  models  that  allow  for  a  dynamic,  distributed 
structure  do  suggest  different  intervention  strategies. 

Krebs  (2002)  drew  the  organization  of  the  9/11  terrorists  as  a  social  network.  This  network  repre¬ 
sentation  can  be  viewed  as  an  expansion  of  the  previous  tree  organizational  structure.  However,  it 
lacks  critical  infonnation  about  the  attack’s  execution.  For  example,  resource  requirements,  task 
assignments,  and  task  dependency  are  not  represented  at  all  in  Krebs’  social  network  visualization. 
Therefore,  the  analysis  lost  the  important  features  in  the  attack.  On  the  other  hand,  from  the  qua¬ 
litative  observations  about  the  adversarial  organizations,  Sageman  (2004)  emphasized  the  impor¬ 
tance  of  social  networks  as  well  as  the  physical  movements  of  terrorists  crossing  borders,  re¬ 
source  seeking,  and  recruit  training.  Again,  this  study  has  taken  the  other  factors  (movements, 
resources,  and  expertise)  into  account. 

Carley  (2006)  provided  a  tool  to  consider  the  multiple  types  of  organizational  elements  and  the 
multiple  types  of  relations  among  them.  This  enabled  the  representation  of  the  complex  organiza¬ 
tions  that  Perrow  (1986),  Thompson  (1967),  and  Child  (1972)  identified  as  the  nature  of  human 
organizations.  Carley’s  approach  produced  very  informed  analysis  results  by  drawing  this  com¬ 
plex  organizational  structure  idea.  Furthermore,  she  linked  this  complex  organization  idea  to  the 
evolution  of  the  organizations  that  Galbraith  (1973)  emphasized  and  that  Stern  (2003a)  and 
Sageman  (2004)  also  observed  in  the  terrorist  network  domain.  However,  her  work  can  be  im¬ 
proved  upon  with  further  integrations  of  critical  aspects  (e.g.  geospatial  movement).  Geospatial 
movement,  or  transnational  movement,  has  been  a  focus  of  counter-terrorism  analysis.  For  exam- 
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pie,  Sageman  (2004),  Champagne  et  al.  (2005),  and  Felter  and  Fishman  (2007)  noticed  the  impor¬ 
tance  of  the  geospatial  aspects  of  the  terrorist  movement.  This  study  builds  on  this  approach  to 
simultaneously  look  at  multiple  key  factors.  Thus,  it  can  generate  more  nuanced  explanations. 

This  work  also  expanded  upon  previous  knowledge  by  including  the  geospatial  dimension  in  the 
analysis  framework.  This  addition  enables  the  importance  of  transnational  movements  to  be  dis¬ 
cerned.  The  simulation  model  implements  known  terrorist  transnational  relocations  by  using  relo¬ 
cation  logics  derived  from  qualitative  and  empirical  research,  mainly  from  Sageman  (2004)  and 
Champagne  et  al.  (2005).  This  geospatial  and  relocation  model  supported  by  the  previous  qualita¬ 
tive  analysis  is  expected  to  produce  better  and  richer  results  than  the  analyses  resulting  from  only 
the  social  dimension.  Thus,  in  this  thesis  adds  key  factors  such  as  spatial  relocation  that  have  an 
empirical  basis  and  expected  that  the  results  would  be  more  nuanced,  more  accurate,  and  lead  to 
different  destabilization  strategies.  While  the  study  has  not  been  able  to  prove  that  the  results  are 
more  accurate,  it  has  demonstrated  that  they  are  more  nuanced  by  accounting  for  new  key  factors, 
as  new  conclusions  have  emerged  about  destabilization. 


10.3.  Theoretical  Contributions 

Most  of  theoretical  contributions  are  made  in  the  process  of  expanding  and  interoperating  dynam¬ 
ic  network  analyses,  decision-making  structure  analyses,  influence  network  analyses,  and  multi¬ 
agent  simulations.  The  theoretical  expansion  is  made  to  interoperate  the  theories  that  are  not  yet 
interoperable.  This  interoperation  enables  new  analysis  frontiers  for  human  analysts,  and  these 
new  frontiers  enable  more  in-depth  and  nuanced  assessments  and  estimations  of  adversaries. 
These  new  assessments  and  estimations  include  1 )  providing  a  multi -plex  network  from  a  single¬ 
relation  network;  2)  assessing  organizational  structures  to  support  their  tasks  with  Bayesian  net¬ 
work  analyses;  and  3)  modeling  human  behavior  in  multiple  dimensions. 

First,  the  present  study  has  expanded  dynamic  network  analyses  from  the  only  observed  network 
analysis  to  the  inferred  network  analysis.  Fluman  analysts  have  speculated  that  there  is  more  than 
one  type  of  social  relations  among  the  adversaries,  but  many  of  observed  organizational  structures 
are  flat  social  networks  without  any  multi-plex  links.  Therefore,  the  use  of  a  dynamic  network 
analysis  that  can  handle  a  multi-modal  and  multi-plex  social  network  has  been  limited.  This  study 
has  enabled  the  reasoning  of  different  types  of  relations  from  a  flat  social  network.  This  expands 
the  use  and  the  application  of  dynamic  network  analysis  by  supplying  multi-plex  networks  from 
flat  networks.  In  detail,  by  inferring  three  different  decision-making  structures  from  the  observed 
network,  we  can  theorize  that  the  observed  social  network  may  contain  three  different  embedded 
social  networks  that  can  be  extracted  from  three  different  perspectives.  From  this  inference  idea, 
and  given  adequate  multi-modal  networks,  analysts  can  now  see  multi-plex  links  in  three  different 
social  networks  among  agents. 

Second,  the  study  expands  the  dynamic  network  analysis  theory  to  include  the  numerical  evalua¬ 
tion  from  a  Bayesian  network.  Fluman  analysts  need  an  answer  the  question,  “Is  this  organization 
capable  enough  to  execute  this  mission?”  with  direct,  task-related  performance  measures  that  are 
not  criticality  metrics  or  indirect  task  performance  measures.  By  using  a  Bayesian  network  tech- 
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nique  to  assess  an  organizational  structure  and  estimating  a  task  related  performance  measure,  the 
study  allowed  for  more  in-depth  analyses  of  adversaries’  task  completion  probabilities  and  their 
ability  to  execute  their  mission.  Specifically,  dynamic  network  analysis  has  developed  various 
metrics  that  evaluates  complex  organizational  structures.  However,  these  metrics  are  limited  to 
the  assessment  of  network  status.  On  the  other  hand,  the  management  community  has  developed 
various  theories  in  assessing  organizational  structures  from  the  task  completion  and  organization¬ 
al  support  perspectives.  Then,  the  managers  familiar  with  the  management  science  will  ask  a 
question  about  how  to  numerically  assess  the  organizational  support  and  task  completion  with  a 
given  complex  organizational  structure  in  the  network  format.  By  using  an  influence  network,  a 
variant  of  a  Bayesian  network,  the  present  study  theorized  an  assessment  method  that  answers 
management  questions  that  are  not  network  status  oriented. 

Third,  the  present  study  expands  the  multi-agent  simulation  theories  to  include  more  than  one 
interaction  dimension.  Multi-agent  simulation  models  are  often  limited  to  a  simulation  of  a  single 
dimension,  (e.g.  a  two-dimensional  grid  space  with  moving  dots,  a  social  network  space  with  in¬ 
teracting  agents,  etc.).  However,  to  model  real  world  situations,  the  simulation  should  be  able  to 
handle  multiple  dimensions  (e.g.  geospatially  moving  military  units  with  social  interactions  based 
on  command  and  control,  transnational  terrorist  movements  with  internet  social  interactions,  etc.). 
By  using  multiple  interaction  dimensions,  analysts  can  see  the  adversarial  behavior  with  more 
complete  and  nuanced  pictures.  This  study  creates  a  simulation  model  considering  social  and 
geospatial  dimensions,  thus  providing  for  more  complete  simulation  analyses  of  adversaries. 


10.4.  Technical  Contributions 

1  developed  and  tested  this  intelligence  analysis  framework  by  implementing  the  theoretical  ideas 
in  an  existing  analysis  program.  Organization  Risk  Analyzer  (ORA).  First,  the  decision-making 
structure  extractor  in  ORA  examines  the  observed  meta-network  and  generates  three  inferred  so¬ 
cial  networks  among  agents  (more  precisely,  decision  makers,  since  the  extracted  networks  are 
determined  by  regarding  the  agents  as  decision  making  entities).  This  function  enables  the  intero¬ 
peration  with  Caesar  III,  a.  decision-making  structure  and  cognitive  process  analysis  application. 
Also,  the  extracted  structures  can  further  analyzed  by  ORA’s  dynamic  network  analysis  capabili¬ 
ty. 

Second,  the  influence  network  generator  in  ORA  assesses  the  organizational  supports  from  the 
task  completion  perspective  in  management.  The  assessments  are  represented  as  an  influence 
network,  a  type  of  Bayesian  network.  The  generated  influence  network  is  also  loadable  by  using 
Pythia,  an  influence  network  analysis  program.  The  influence  network  and  Pythia  calculate  the 
marginal  probabilities  of  task  completion  likelihoods.  This  technical  achievement  also  enables  the 
faster  generation  of  influence  network  which  usually  take  very  long  subject  matter  experts’  time. 

Third,  I  developed  a  multi-agent  simulation  model,  JDynet.  JDynet  is  originally  from  Construct 
(Carley,  1991),  but  JDynet  was  significantly  modified  to  accommodate  the  idea  of  operations  re¬ 
search,  rather  than  sociological  concepts.  With  the  modification,  JDynetSpatial  could  handle  the 
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social  and  geospatial  aspects  of  an  organization.  Also,  JDynetSpatial  could,  in  the  more  nuanced 
manner,  estimate  the  mission  completion  timeline  and  organizational  element  transfers  to  com¬ 
plete  the  mission. 

10.5.  Empirical  Contributions 

Throughout  this  work,  I  applied  the  developed  framework  to  the  datasets  about  the  1998  U.S. 
Embassy  Bombing  Incidents  in  Kenya  and  Tanzania.  By  applying  different  approaches,  I  gener¬ 
ated  more  sense-making  analysis  results  compared  to  previous  analysis  practices,  i.e.  simple  so¬ 
cial  network  metric  calculations. 

This  particular  application  results  found  that  some  key  actors  that  were  over-  or  under-estimated 
before.  For  example,  Anas  at -Li by  was  the  task  coordinator  who  had  higher  network  metrics  in 
the  result  sharing  structure  than  in  the  original  structure.  A /  Owali  was  the  top  critical  actor  in  the 
observed  structure  and  the  information  sharing  structure.  However,  in  the  result  sharing  structure, 
Fazul  Abdullah  Mohamed  had  a  higher  dynamic  network  metric  value  than  A I  Owali. 

The  analysis  results  identified  tasks  that  have  low  completion  likelihood,  such  as  conceal  bomb  in 
car  and  provide  money ,  because  the  tasks  are  under-supported  by  the  organization.  In  contrast, 
review  surveillance  files,  film  videotape  announcing  martyrdom,  and  surveillance  of  possible  tar¬ 
gets  show  high  task  completion  likelihoods,  indicating  good  organizational  supports  from  adver¬ 
saries.  As  the  operational  environment  setting  changes,  overall  planning  and  execution  and  bomb 
preparation  showed  big  changes  in  the  completion  likelihood,  which  means  that  we  can  drop  the 
completion  likelihood  by  a  wide  margin  if  we  are  able  to  change  the  operation  environment  of  the 
adversaries. 

Simulations  with  only  a  social  model  shows  that  removing  higher  degree  and  betweenness  agents 
in  large  number  at  the  early  stage  would  be  effective.  However,  this  may  not  be  achievable  in  the 
real  world.  The  simulation  analysis  identified  bottleneck  tasks,  such  as  the  rent  residence  task, 
that  had  the  longest  execution  time  across  the  tasks  during  the  mission.  The  simulations  identified 
the  organizational  element  transfer  networks  among  agents.  There  are  agents,  (e.g.  Wadih  ei- 
Hage )  who  consistently  appeared  in  the  transfer  network  over  time. 

The  social  and  geospatial  model  simulation  suggests  that  the  agents  are  segregated  around  the 
Somalia,  Pakistan,  and  Afghanistan  regions  when  the  initial  training  and  education  happens  be¬ 
cause  these  regions  are  linked  to  training  resources  and  regional  expertise  (e.g.  weapons  expertise 
at  the  Somalia  training  base).  Afterwards,  the  agents  move  from  the  above  regions  to  actual  mis¬ 
sion  regions,  Tanzania  and  Kenya.  The  identified  key  individual  lists  are  partly  different  from  the 
list  of  the  social  only  model.  The  extended  model  indicates  Al  Owali  is  more  important  than  the 
estimation  from  the  social  only  model  in  the  betweenness  centrality  perspective  of  agent-to-agent 
organizational  element  transfer  networks.  Previously,  Wadih  el-Hage  was  considered  to  be  the 
most  critical  actor  in  the  transfer  network  of  the  social  only  model. 
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More  empirical  analysis  results  are  provided  in  Chapters  5,  6,  7  and  8.  These  computational  re¬ 
sults  can  be  interpreted  by  human  analysts  with  subject  matter  expertise,  and  the  analysts  can  ve¬ 
rify  the  plausibility  of  the  computational  results  and  determine  whether  or  not  to  include  them  in 
their  destabilization  analysis  report. 

10.6.  Big  Picture 

As  human  organizations  become  more  complex  and  dynamic  with  technological  and  management 
innovations,  we  need  a  more  sophisticated  tool  to  analyze  them.  Human  analysts  can  perform  an 
insightful  qualitative  analysis  of  an  organization,  however  they  demand  a  computational  tool  to 
process  their  analyses  more  quickly  and  broadly.  At  the  same  time,  they  do  not  want  to  abandon 
their  subject  matter  experience,  wisdom,  and  instinct.  Therefore,  researchers  have  to  provide  an¬ 
swers  to  the  following  questions:  1)  how  to  create  a  computational  tool  for  this  human  oriented, 
uncertain  domain;  and  2)  how  to  incorporate  human  wisdom  into  the  process  of  computational 
analysis.  Obviously,  the  researchers  have  to  use  the  theories  from  the  computational  analysis 
fields  (computer  science,  statistics,  etc)  as  well  as  the  human  organization  research  fields  (man¬ 
agement,  sociology,  etc). 

Then,  the  researchers  providing  such  computational  tools  will  have  to  produce  theories  and  ap¬ 
proaches  to  mitigate  and  integrate  the  two  types  of  fields.  This  work  is  only  a  small  demonstra¬ 
tion  of  such  a  research  fusion.  Throughout  this  work,  1  created  interfaces  that  mitigate  two  or 
more  different  analysis  practices.  Often,  1  expanded  one  theory  among  related  theories,  so  that  the 
chosen  theory  could  take  advantage  of  the  other  theories’  merits.  This  theoretical  expansion  from 
interdisciplinary  research  1)  enables  researchers  to  meet  the  real  world  demand  for  the  computa¬ 
tional  tools;  and  2)  offers  feedback  on  the  original  theories  and  facilitates  the  further  development 
of  individual  theories. 

This  study  helps  human  analysts  in  multiple  ways.  Now,  the  human  analysts  can  handle  bigger 
and  more  complex  organizations  with  the  support  of  an  integrated  computational  analysis  tool.  At 
the  same  time,  the  human  analysts  can  apply  their  wisdom  to  the  process  of  the  analysis.  Finally, 
the  human  analysts  can  get  more  nuanced  analysis  results  such  as  the  adversaries’  more  nuanced 
behavior  estimations,  organizational  supports  for  task  executions,  critical  decision  making  struc¬ 
tures  hidden  in  an  observed  social  network. 

10.7.  Future  Research 

This  work  still  needs  further  validation,  though  the  analysis  models  are  designed  to  be  rational 
and  follow  well-known  qualitative  analysis  results.  I  suggest  that  there  are  two  validation  ap¬ 
proaches  for  this  analysis  system  and  procedure.  The  first  validation  approach  is  validating  the 
usability  of  this  analysis  framework1 '.  Some  analysts  will  see  this  system  as  a  computational  tool 
that  substitutes  their  work  previously  done  by  hand.  In  that  case,  providing  good  services  to  the 
users  is  an  important  evaluation  point.  This  can  be  done  by  deploying  this  system  to  real  users 


13  The  framework  means  the  overall  analysis  procedure  and  system. 
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and  obtaining  their  feedback.  After  getting  their  feedback,  we  can  enhance  the  procedure  and  sys¬ 
tem  further.  Also,  some  of  models  may  need  to  be  adjusted  according  to  users’  requests.  For  ex¬ 
ample,  analysts  may  want  more  factors  to  be  included  in  the  automated  influence  network  genera¬ 
tion.  If  this  is  the  case,  we  can  increase  the  value  of  this  contribution  by  selectively  following  the 
analysts’  requests. 

The  second  validation  approach  involves  validating  the  outcome  of  this  analysis  framework.  This 
approach  is  already  discussed  in  Chapter  9.5.  Some  analysts  will  see  this  system  as  a  calibrated 
and  automated  prediction  tool.  First  of  all,  this  type  of  system,  particularly  analyzing  social  beha¬ 
vior,  would  not  be  accurate  as  the  analysis  system  of  electric  circuits.  However,  human  analysts 
may  still  want  to  see  that  this  tool  makes  estimations  that  are  either  1 )  observed  in  the  past  or  2) 
reasonable  to  accept.  As  discussed  in  Chapter  9.5,  we  need  to  apply  this  framework  to  more  con¬ 
tained  and  better  observable  contexts  (e.g.  software  companies,  friendly  forces,  etc.).  Then,  we 
may  obtain  better  datasets  that  can  be  input  to  the  framework  as  well  as  solution  sheet  of  the 
analysis  answers.  This  validation  will  create  many  interesting  research  questions:  optimizing 
analysis  parameters  with  partial  observation,  comparing  the  simulated  data  to  the  real-world  data, 
etc.  It  is  my  hope  that  my  colleagues  in  this  community  or  I  will  oversee  this  validation  process. 
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11.  Appendix  -  Scalability  Analysis 


This  chapter  analyzes  the  scalability  of  the  introduced  approaches.  The  introduced  new  approach¬ 
es  utilize  various  computational  components,  and  these  computational  parts  require  more  compu¬ 
tations  as  the  organizational  size  grows.  For  instance,  our  investigation  scope  is  limited  to  a  task- 
oriented  organization  with  hundreds  of  agents.  This  is  a  good  enough  scale  for  analyzing  a  me¬ 
dium  sized  company,  a  regiment,  or  a  not  such  a  big  sized  terrorist  group.  If  the  organizational 
sizes  are  thousands  of  agents,  then  the  organizational  boundary  might  be  defined  from  the  socio¬ 
logical  perspective,  not  from  the  task  oriented  perspective.  The  purpose  of  this  scalability  analysis 
is  demonstrating  that  the  approaches  can  handle  task-oriented  organizations  with  hundreds  of 
agents. 

11.1.  Scalability  from  the  human  cognitive  perspective 

Humans  have  limitations  in  recognizing  the  complex  organizational  structure.  For  example,  Ber¬ 
nard  et  al.  (1984)  points  out  that  humans  usually  reports  inaccurate  data  when  they  reports  events, 
relations,  assignments,  etc.  This  incorrect  perception  of  social  structure  is  also  noted  in  social 
networks  (Krackhardt,  1987).  Therefore,  understanding  a  complex  organizational  structure  in  this 
thesis  is  very  difficult  for  human  analysts  without  proper  tools.  Furthermore,  designing  interven¬ 
tion  strategies  against  this  complex  structure  will  make  human  analysts  rely  on  their  instincts  if 
we  do  not  provide  proper  tools  to  them.  Unfortunately,  I  could  not  find  a  literature  that  reports 
how  many  nodes  and  which  topologies  are  the  boundary  of  human  cognition  for  understanding 
the  network.  However,  the  above  literatures  emphasize  the  necessity  of  tools  for  analyzing  com¬ 
plex  organizations. 

On  the  other  hand,  there  are  opinions  that  the  analysis  tools  become  just  black  boxes  when  the 
inputs  and  models  go  beyond  human  analysts’  cognition  level.  For  example,  a  human  analyst  may 
understand  and  design  an  organization  with  10  individuals  by  his  intuition  without  a  computa¬ 
tional  tool.  The  analyst  may  perform  his  analysis  better  with  a  computational  tool,  so  the  analyst 
regards  the  tool  as  “a  smart  calculator”  that  performs  a  computational  analysis  that  the  analyst  can 
do  himself,  yet  in  the  faster  and  more  accurate  manner.  Also,  in  this  case,  the  human  analyst  can 
track  down  the  problem  or  doubts  about  the  computation  result  from  the  input  and  the  tool.  How¬ 
ever,  this  problem  resolution  becomes  impossible  if  his  analysis  target  consisted  of  1 000  men  un¬ 
less  the  analyst  thoroughly  understands  the  models  inside  the  tool  and  has  confidence  that  the  tool 
and  model  is  verified. 

This  discussion  leads  an  interesting  question:  what  is  the  organization  size  threshold  for  a  human 
analyst  when  the  analyst  tries  to  understand  the  complex  organization?  To  my  knowledge,  there  is 
no  study  answering  the  above  question  directly.  Also,  from  the  computational  analysis  tool  usa¬ 
bility  perspective,  there  is  another  question:  when  and  what  point  do  human  analysts  feel  com¬ 
fortable  for  applying  this  type  of  computation  analysis  tools  to  his  analysis?  If  this  usability  is 
dependent  on  the  size  of  an  organizational  structure,  the  size  range  for  maximizing  the  usability 
would  be  the  critical  organization  size  range  that  we  make  our  tools  operable  within.  I  think  that 
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this  issue  is  often  brought  upon  by  analysts  actually  using  this  tool.  However,  my  literature  re¬ 
view  finds  that  there  is  no  critical  and  direct  study  about  this  issue.  I  believe  that  this  should  be  a 
future  research  to  make  this  type  of  tools  and  approaches  more  acceptable  by  actual  users. 

11.2.  Scalability  from  the  technical  run  time  perspective 


Particularly,  1  analyze  the  scalability  from  the  two  viewpoints.  First,  1  run  the  approaches  multiple 
times  and  empirically  demonstrate  the  approaches  can  handle  an  organization  with  more  than  500 
agents.  Second,  I  analyze  the  worst  case  run  time  with  a  big-Oh  notation,  which  demonstrates  the 
theoretical  scalability. 

The  empirical  experiments  are  done  in  the  below  computational  environment. 

•  Intel®  Core™2  Duo  CPU  T9300  @  2.50GHz 

•  4030MB  RAM 

•  64  Bit  Operating  System 

•  Java  Virtual  Machine  1.6.0 

•  Non  threaded  analysis  runs 

The  below  analyses  regard  |A|  as  the  number  of  agents,  |AA|  as  the  number  of  edges  in  the  Agent- 
to-Agent  social  network,  |T|  as  the  number  of  tasks,  |AT|  as  the  number  of  edges  in  the  Agent -to- 
Task  assignment  network,  |TT|  as  the  number  of  edges  in  the  Task-to-Task  dependency  network, 
|RT|  as  the  number  of  edges  in  the  Resource-to-Task  requirement  network,  |KT|  as  the  number  of 
edges  in  the  Knowledge-to-Task  requirement  network,  and  |MN|  as  the  number  of  edges  in  the 
meta  network. 


11.3.  Scalability  of  decision  making  structure  analysis 


Empirical  analysis  time:  Table  11-1  shows  the  empirical  running  time  of  the  decision  making 
structure  analyses  applied  to  three  different  datasets  introduced  in  Ch.  4.  With  more  than  500 
agents,  it  takes  only  a  little  more  than  7  seconds  to  generate  the  structure.  However,  this  analysis 
time  does  not  include  any  of  subsequent  social  network  analysis.  Also,  this  result  depends  on  the 
density  of  social  networks  and  the  number  of  tasks  involved. 


Table  11-1  Run  time  of  decision  making  structure  analyses  (10  replications) 


Dataset 

Number  of 

Number  of 

Number  of 

Meta  Net¬ 
work  Densi¬ 
ty 

Avg.  Run 

Std.  Run 

Time 

(Sec) 

Agents 

Nodes 

Edges 

Time  (Sec) 

Kenya 

16 

49 

148 

0.117 

1.286 

0.077 

Tanzania- 

Kenya 

18 

75 

369 

0.127 

2.885 

0.080 

Global 

597 

2008 

77298 

0.031 

2173.001 

67.349 
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Big-Oh  analysis:  There  are  three  major  components  in  the  decision  making  structure  analysis. 
The  major  components  are  1)  information  sharing  structure  extraction,  2)  result  sharing  structure 
extraction  and  3)  command  interpretation  structure  extraction.  1  analyze  the  Big-Oh  of  the  three 
components. 

The  Big-Oh  analysis  for  the  entire  decision  making  structure  analysis  is  the  dominant  term  of  the 
below  three  Big-Oh  analysis  results  from  three  sub  components. 


These  Big-Oh  analyses  are  valid  under  an  assumption  that  1)  the  agents  do  not  have  any  required 
organizational  elements  (resources  or  expertise)  to  their  tasks  and  2)  the  shortest  path  finding  time 
costs  the  worst  time  of  Dijkstra  algorithm  run  time. 


(Run  Time  of  Information  Sharing  Structure  Extraction) 

=  (Number  of  Agents)  x  (Assigned  Tasks) 
x  (Required  Expertise  and  Resources) 

^  |  Run  Time  of  Shortest  Path  Findings  from  an  Assigned  Agent 


to  the  Required  Element  through  social  networks 


=  o^i  Aim 


|RT|  +  |KT| 

iff 


|AA|  log|A|  =  0(|A|(|RT|  +  |KT|)]AA]log|A|) 


(Run  Time  of  Result  Sharing  Structure  Extraction) 

=  (Number  of  Agents)  x  (Assigned  Tasks)  X  (Average  Num.of  Next  Tasks) 


x  (Average  Num.of  Assigned  Agents  to  a  Next  Task) 

lAllATHTTI 
|T|  j 


=  0 


|TT|  |AT|\ 

in  mi/ 


(Run  Time  of  Command  Interpretation  Structure  Extraction) 

=  (Number  of  Agents)  x  (Number  of  Agnet  Neighbor  from  Outgoing  Links) 

X  (Run  Time  of  Shortest  Path  Findings  from  an  Agent  to  a  Outgoing  neighbor  agent  to  Check  the  cycle) 


=  0  ^|A|^  |AA|  log|A|)  =  0(|AA|2  log|A|) 


11.4.  Scalability  of  influence  network  analysis 


The  influence  network  analysis  has  two  analysis  parts.  One  is  generating  an  influence  network, 
and  the  other  is  evaluating  an  influence  network.  The  run-time  of  the  evaluation  can  take  different 
amounts  of  time  according  to  the  used  evaluation  method.  I  use  the  CAST  algorithm  (Rosen  and 
Smith,  1996),  so  I  analyze  the  run  time  of  the  CAST  logic. 


Empirical  analysis  time: 


Table  11-2 


shows  the  empirical  running  time  of  the  influence  network 


analyses  applied  to  three  different  datasets  introduced  in  Ch.  4. 
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Table  11-2  Run  time  of  influence  network  analyses  (10  replications) 


Influence  network  generation 

Influence  network  evaluation 

Dataset 

Avg.  Run 

Time  (Sec) 

Std.  Run 

Time  (Sec) 

Avg.  Run 

Time  (Sec) 

Std.  Run 

Time  (Sec) 

Kenya 

0.076 

0.015 

0.036 

0.029 

T  anzania-Kenya 

0.373 

0.047 

0.126 

0.040 

Global 

303.135 

48.892 

257.666 

1.310 

Big-0h  analysis:  There  are  two  major  components  in  the  influence  network  analysis.  The  two 
components  are  1)  generating  an  influence  network  and  2)  evaluating  an  influence  network. 

The  overall  Big-Oh  analysis  result  for  the  influence  network  analysis  is  the  dominant  term  of  the 
below  two  Big-Oh  analysis  results. 

1)  Generating  an  influence  network 

I  use  the  Dijkstra  algorithm  to  figure  out  the  involvement  of  a  task  to  a  task  dependency  network 
for  a  task  of  interest.  Specifically,  I  examine  the  shortest  path  from  a  task  to  the  task  of  interest. 
Also,  the  assessment  for  various  factors  of  a  single  task  takes  almost  constant  time  because  the 
function  can  look  up  the  neighbor  of  the  task  nodes  in  the  meta-network  in  constant  time.  In  this 
analysis,  I  assume  that  every  task  is  involved  in  the  task  dependency  network  of  the  task  of  inter¬ 
est. 

(Run  Time  of  Influence  Network  Generation) 

=  (Number  of  tasks)  x  (Figuring  out  the  involvement  of  a  task) 

+  (Number  of  involved  tasks) 
x  {(Task  prerequisite  assignment  configuration) 

+  (Personnel  sufficiency  configuration  for  task) 

+  (Task  complexity  assessment)  +  (Task  importance  assessment) 

+  (Available  expertise  assessment)  +  (Accessible  resource  assessment)} 

=  OQT[ ITT] log|T|)  +  0(|T|  x  Constant)  =  0(|T||TT|log|T|) 

2)  Evaluating  an  influence  network 

When  evaluating  an  influence  network,  each  influence  network  need  an  approximated  conditional 
probability  table  which  has  2X  different  cases  with  X  number  of  connected  parent  nodes. 
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(Run  Time  of  Evaluating  an  Influence  Network) 

=  (Number  of  task  completion  node) 

y  2KPrevioustask  compIetionnode}+(5  assessment  no deE}} _ 

iTTl 

=  0(|T|x2TfT) 


11.5.  Scalability  of  multi-agent  social  only  model 


The  run  time  of  a  multi-agent  simulation  model  differs  a  lot  depending  on  users’  parameters,  i.e. 
the  number  of  simulation  time-step.  I  simulate  for  1000  time  steps  for  empirical  analysis.  All  the 


other  parameters  use  the  default  value  which  is  listed  in  Table  7-1 


and  Table  8-1 


Empirical  analysis  time: 


Table  11-3 


shows  the  empirical  running  time  of  the  influence  network 


analyses  applied  to  three  different  datasets  introduced  in  Ch.  4. 


Table  11-3  Run  time  of  multi-agent  social  only  model  simulations  (10  replications) 


Prior  Simulation 

Actual  Simu 

ation 

Post  Simulation 

Dataset 

Avg.  Run 
Time  (Sec) 

Std.  Run 
Time  (Sec) 

Avg.  Run 
Time  (Sec) 

Std.  Run 
Time  (Sec) 

Avg.  Run 
Time  (Sec) 

Std.  Run 
Time  (Sec) 

Kenya (400 
time  steps) 

0.003 

0.005 

0.728 

0.078 

0.052 

0.011 

Tanzania- 
Kenya (2500 
time  steps) 

0.031 

0.002 

5.421 

0.309 

1.082 

0.124 

Global  (2000 
time  steps) 

39.925 

7.050 

6981.723 

1089.270 

956.231 

108.230 

Big-0h  analysis:  The  agent  interaction  time  is  the  dominant  factor  in  the  run-time  of  multi-agent 
simulations.  The  output  configuration  and  generation  takes  much  longer  time  than  the  actual  si¬ 
mulation  time.  However,  this  output  time  depends  on  the  performance  of  file  system,  XML  pars¬ 
ing  package  performance,  etc,  so  there  are  variables  that  1  do  not  have  information  about.  Howev¬ 
er,  I  can  analyze  the  actual  simulation  time  (Average  Run  Time  for  Actual  Simulation).  Below  is 
the  analysis  of  the  actual  simulation  time. 


CMU  SCS  ISR 


-205- 


CASOS  Report 


(Run  Time  of  Multiagent  Social  Only  Simulation) 

=  (Number  of  Timestep)  x  (Number  of  Agents) 
x  (Run  Time  of  Interaction  of  a  single  agent) 

=  0(|Timestep|  |A| 

X  {(Handling  transactive  memory) 

+  (Resource  and  Expertise  Handling  considering  AR  and  AK) 

+  (Task  Execution  consider  AT,  RT,  KT  and  TT)}) 

/,  „  ,  ,  |AR|  +  |AK|  +  1ATI  +  |RT|  +  |KT|  +  1TT|\ 

=  0  (  |Timestep|  |A|  X  (Constant  H - — - j 

=  0(|Timestep||MN  without  location  related  nodes  and  links[) 

11.6.  Scalability  of  multi-agent  social  and  geospatial  model 


The  run  time  of  the  social  and  geospatial  model  takes  longer  time  than  the  execution  of  the  social 
only  model.  Though  this  addition  is  just  an  extension  of  agent  behavior,  it  changes  the  characte¬ 
ristic  of  run  time  because  of  more  inputs  and  outputs  particularly  in  the  post  simulation  process 
time.  I  simulate  for  1000  time  steps  for  empirical  analysis.  All  the  other  parameters  use  the  de- 

andP 


fault  value  which  is  listed  in  Table  7-1 


Table  8-1 


Empirical  analysis  time: 


Table  11-4 


shows  the  empirical  running  time  of  the  influence  network 


analyses  applied  to  three  different  datasets  introduced  in  Ch.  4. 


Table  11-4  Run  time  of  multi-agent  social  and  geospatial  model  simulations  (10  replications) 


Prior  Simulation 

Actual  Simulation 

Post  Simulation 

Dataset 

Avg.  Run 
Time  (Sec) 

Std.  Run 
Time  (Sec) 

Avg.  Run 
Time  (Sec) 

Std.  Run 
Time  (Sec) 

Avg.  Run 
Time  (Sec) 

Std.  Run 
Time  (Sec) 

Kenya (400 
time  steps) 

0.002 

0.001 

0.715 

0.026 

0.061 

0.013 

Tanzania- 
Kenya (2500 
time  steps) 

0.049 

0.004 

5.816 

0.334 

1.300 

0.088 

Global  (2000 
time  steps) 

63.119 

46.628 

7491.853 

3893.452 

1071.200 

6420.653 

Big-0h  analysis:  The  agent  interaction  and  relocation  time  is  the  dominant  factor  in  the  run-time 
of  midti-agent  simulations.  The  output  configuration  and  generation  takes  much  longer  time  than 
the  actual  simulation  time  as  in  the  run  time  of  the  social  only  model,  see  Ch.  10.3.  I  analyze  the 
actual  simulation  time  (Average  Run  Time  for  Actual  Simulation).  Below  is  the  analysis  of  the 
actual  simulation  time. 
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(Run  Time  of  Multiagent  Social  and  Geospatial  Simulation) 

=  (Number  of  Timestep)  x  (Number  of  Agents) 
x  {(Run  Time  of  Interaction  of  a  single  agent) 

+  (Run  Time  of  Relocation  of  a  single  agent) 

=  0(|Timestep|  |  A] 

X  {(Handling  transactive  memory) 

+  (Resource  and  Expertise  Handling  considering  AR  and  AK) 

+  (Task  Execution  consider  AT,  RT,  KT,  TLand  TT) 

+  (Relocation  to  a  neighbor  location) 

+  (Location  transactive  memory  handling ,  RL,  KL)}) 

=  0  ^]Timestep|  |A|  x  (Constant 

1AR|  +  |AK|  +  |  ATI  +  |RT1  +  |KT|  +  ITT]  +  |TL|  +  |RL|  +  |KL|  |LL|\ 
+  IM  +lLf) 

IA1ILLI 

=  0(lTimestep|  |MN  [  -1 - — — ) 

IlM 


11.7.  Summary  of  the  technical  scalability  analysis 


1  showed  the  scalability  of  the  analysis  components  theoretically  and  empirically.  The  theoretic 
big-Oh  analysis  suggests  that  the  analysis  scalability  depends  on  the  number  of  nodes  and  links  in 
a  meta-network.  Hence,  I  summarize  the  relation  between  the  number  of  nodes  and  links  and  the 
big-Oh  analysis  in  Table  11-5  While  reading  Table  11-5 


it  should  be  noted  that  I  did  not  consi¬ 


dered  a  simultaneous  change  of  node  and  link  numbers.  For  example,  if  the  number  of  agents  in¬ 
creases,  it  is  very  likely  to  see  the  increase  in  the  number  of  agent -to-agent  network  and  meta¬ 


network.  However,  such  changes  are  not  considered  in  Table  11-5  This  type  of  changes  is  subject 


to  the  nature,  i.e.  topology  or  organizational  work  relation  tightness,  of  the  observed  organization. 


Table  11-5  Summary  of  scalability  analysis,  relation  between  the  number  of  nodes  and  links  in  a  me¬ 
ta-network  and  the  big-Oh  analysis  result,  for  decision  making  structure  analysis,  1  show  the  domi¬ 
nating  term  out  of  three  sub-components. 


Linear  in¬ 
crease  of 

number  of 
nodes, 
links,  or 
parameters 

Decision  mak¬ 
ing  structure 
analysis 

Influence 
Network 
analysis:  gen¬ 
eration  phase 

Influence 

Network 

analysis: 

evaluation 

phase 

Multi-agent 
simulation: 
social  only 
model 

Multi¬ 
agent  si¬ 
mulation: 
social  and 
geospatial 
model 

Agents 

Linear 

Doesn’t 

Change 

Doesn’t 

Change 

Doesn’t 

Change 

Linear 

Tasks 

Doesn’t 

Change 

Linear 

Linear 

Doesn’t 

Change 

Doesn’t 

Change 

Locations 

Doesn’t 

Change 

Doesn’t 

Change 

Doesn’t 

Change 

Doesn’t 

Change 

Doesn’t 

Change 
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Agent-to- 

Agents 

Square 

Doesn’t 

Change 

Doesn’t 

Change 

Linear 

Linear 

Agent-to- 

Tasks 

Linear 

Doesn’t 

Change 

Doesn’t 

Change 

Linear 

Linear 

Resource- 

to-Tasks 

Linear 

Doesn’t 

Change 

Doesn’t 

Change 

Linear 

Linear 

Expertise- 

to-Tasks 

Linear 

Doesn’t 

Change 

Doesn’t 

Change 

Linear 

Linear 

Task-to- 

Tasks 

Linear 

Linear 

Exponential 

Linear 

Linear 

Location- 

to-Location 

Doesn’t 

Change 

Doesn’t 

Change 

Doesn’t 

Change 

Doesn’t 

Change 

Linear 

Meta¬ 

network 

links 

Square 

Linear 

Exponential 

Linear 

Linear 

Simulation 

Timestep 

Doesn’t 

Change 

Doesn’t 

Change 

Doesn’t 

Change 

Linear 

Linear 
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12.  Appendix-the  1998  U.S.  Embassy  bombing  incident  in  Kenya 


I  apply  the  same  approach  to  the  1998  U.S.  Embassy  bombing  incident  in  Kenay  dataset  (see  Ch. 
4.3).  Below  is  the  analysis  results  corresponding  to  the  results  of  the  main  chapters. 

12.1.  Decision  making  structure  analysis 

Figure  12-1  visualizes  the  extracted  three  decision  making  structures.  As  expected,  the  informa¬ 
tion  sharing  looks  similar  to  the  original  social  network,  but  the  result  sharing  is  very  different 
from  the  original  network.  The  command  interpretation  structure  is  very  trimmed  version  of  the 
observed  social  network. 


Abdel  Rahman. 

^Wadih  el-Hage 

[Osama  Bin  Laden 


Figure  12-1  Three  extracted  decision  making  structures  (Top)  Information  Sharing,  (Middle)  Result 
Sharing,  (Bottom)  Command  Interpretation 


Table  12-1  and  Table  12-2  show  the  correlation  between  the  observed  social  network  and  the  de¬ 
cision  making  structures.  The  result  sharing  structure  is  not  close  to  the  observed  social  network 
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while  the  information  sharing  structure  is  similar  to  the  observed  social  network.  This  means  that 
human  analysts  can  obtain  a  new  information  by  pulling  out  the  result  sharing  structure. 


Table  12-1  QAP  correlation  and  other  distance  metrics  between  the  observed  structure  and  the  ex¬ 
tracted  decision  making  structures.  (IS=Information  Sharing,  RS=Result  Sharing,  CI=Command 
Interpretation) 


Cl 

IS 

RS 

Correlation 

0.226 

0.844 

0.174 

Significance 

0.010 

0.000 

0.070 

Hamming  Dis¬ 

tance 

32.000 

10.000 

81.000 

Euclidean  Dis¬ 

tance 

5.657 

3.162 

9.000 

Table  12-2  regression  results.  The  dependent  network  is  the  observed  meta-network,  and  the  inde¬ 
pendent  networks  are  the  extracted  meta-network.  (R-Squared  =  0.  717) 


Variable 

Coef 

Std.Coef 

Sig.Y- 

Penn 

Sig.Dekker 

Constant 

0.019 

0.000 

Cl 

0.207 

0.054 

0.310 

0.030 

IS 

0.789 

0.844 

0.000 

0.000 

RS 

-0.030 

-0.041 

0.370 

0.220 

Table  12-3  suggests  the  top  individuals  from  the  observed  and  the  extracted  structures.  With  the 
observed  social  network,  Al  Owali  seems  to  have  the  highest  degree  centrality.  However,  when 
considering  the  embedded  decision  making  structure,  Osama  Bin  Laden  (in  the  information  shar¬ 
ing),  Muhammed  Atef  (m  the  result  sharing)  and  Wadih  el-Hage  (in  the  command  interpretation) 
have  the  highest  degree  centrality.  These  new  important  actors  imply  that  there  are  hidden  key 
players  in  this  network  if  we  consider  its  decision  making  structure  for  key  task  execution. 


Table  12-3  Top  three  individuals  from  five  metrics  and  four  structures  (OBS=observed  meta¬ 
network,  IS=Information  Sharing,  RS=Result  Sharing,  CI=Command  Interpretation) 


Measure 

Struc¬ 

ture 

Rank  1 

Rank  2 

Rank  3 

OBS 

Fazul  Abdullah  Mo¬ 

Abdullah  Ahmed  Ab¬ 

Al  Owali 

hammed 

dullah 

Total  Degree  Cen¬ 
trality 

IS 

Osama  Bin 

Laden 

Fazul  Abdullah  Mo¬ 
hammed 

Abdullah  Ahmed  Ab¬ 
dullah 

RS 

Muhammed 

Abdullah  Ahmed  Ab¬ 

Atef 

dullah 

Osama  Bin  Laden 

Cl 

Wadih  el- 

Osama  Bin  Laden 

Abdel  Rahman 
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Measure 

Struc¬ 

ture 

Rank  1 

Rank  2 

Rank  3 

Hage 

OBS 

Al  Owali 

Abdel  Rahman 

Wadih  el-Hage 

IS 

Wadih  el- 

Fazul  Abdullah  Mo¬ 

Betweenness  Cen¬ 
trality 

Hage 

Osama  Bin  Laden 

hammed 

RS 

Al  Owali 

Jihad  Mohammed  AN 

Fazul  Abdullah  Mo¬ 
hammed 

Cl 

Wadih  el- 

Fazul  Abdullah  Mo¬ 

Abdullah  Ahmed  Ab¬ 

Hage 

hammed 

dullah 

OBS 

Osama  Bin 

Laden 

Muhammed  Atef 

Hamza  al-Liby 

IS 

Osama  Bin 

Eigenvector  Cen¬ 

Laden 

Hamza  al-Liby 

Muhammed  Atef 

trality 

RS 

Muhammed 

Abdullah  Ahmed  Ab¬ 

Atef 

dullah 

Osama  Bin  Laden 

Cl 

Wadih  el- 

Hage 

Osama  Bin  Laden 

Abdel  Rahman 

OBS 

Al  Owali 

Jihad  Mohammed  AN 

AN  Mohammed 

Cognitive  Demand 

IS 

Al  Owali 

AN  Mohammed 

Wadih  el-Hage 

RS 

Al  Owali 

Abdel  Rahman 

Wadih  el-Hage 

Cl 

Al  Owali 

AN  Mohammed 

Wadih  el-Hage 

OBS 

Anas  al-Liby 

Abdel  Rahman 

Osama  Bin  Laden 

IS 

Abdullah  Ahmed  Ab¬ 

Anas  al-Liby 

dullah 

Osama  Bin  Laden 

Communication 

RS 

Abdullah  Ahmed  Ab¬ 

Anas  al-Liby 

dullah 

Osama  Bin  Laden 

Cl 

Abdullah  Ahmed  Ab¬ 

Anas  al-Liby 

dullah 

Osama  Bin  Laden 

Figure  12-2  displays  the  discrepancy  between  the  observed  social  network  structure  and  the  ex¬ 
tracted  decision  making  structures  (See  Table  12-4  for  ID  matching  with  real  names).  Osama  Bin 
Laden  (A3)  and  Wadih  el-Hage  (A4)  are  the  two  terrorists  with  high  betweenness  centrality  in  the 
information  sharing  structure.  These  two  actors  are  not  considered  as  key  betweenness  centrality 
players  in  the  observed  structure.  This  means  that  the  two  actors  are  hidden  information  broker 
from  the  mission  execution. 
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Figure  12-2  Charts  displaying  the  difference  of  metrics  between  a  meta-network  and  extracted  struc¬ 
tures 


Table  12-4  l.D.  assignments  to  individuals.  I.D.s  will  be  used  to  distinguish  individuals  in  the  later 
tables.  We  used  some  abbreviations  for  names 


ID 

AO 

A1 

A2 

A3 

A4 

A5 

A6 

Name 

Mu- 

hamme 

Fazul  Ab¬ 
dullah  Mo- 

Abdullah 

Ahmed 

Osama  Bin 

Wadih 

Anas  al- 

d  Atef 

Mo- 

Abdullah 

Laden 

el-Hage 

Li  by 

Al  Owali 
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hammed 

ID 

A7 

A8 

A9 

A10 

All 

A12 

A13 

Name 

Ali  Mo- 

hamme 

d 

Khlid  Al 

Fawaz 

Abdel 

Rahman 

Ayman  al- 

Zawahiri 

Hamza 

al-Liby 

Al  Banshi- 

ri 

Jihad  Mo¬ 
hammed 

Ali 

Table  12-5  shows  the  two  principal  components  for  each  of  the  two  structures:  the  observed 
structure  and  the  extracted  decision  making  structure.  For  the  observed  structure,  the  higher  first 
principal  component  means  less  communication  demand  to  complete  their  tasks.  The  higher 
second  principal  component  means  that  more  connections  to  Other  personnel.  For  the  extracted 
structure,  the  higher  first  component  means  less  communication  demand  to  complete  their  tasks. 
The  higher  second  principal  component  means  that  more  connections  to  Other  personnel. 


Table  12-5  Coefficients  of  two  principal  components  from  the  observed  structure  (top)  and  the  ex¬ 
tracted  structures  (bottom) 


Structure 

Prin.  Comp.  1 

Prin.  Comp.  2 

Total  Degree  Centrality 

OBS 

-0.079 

0.472 

Betweenness  Centrality 

OBS 

-0.002 

0.013 

Eigenvector  Centrality 

OBS 

-0.118 

0.608 

Cognitive  Demand 

OBS 

-0.104 

0.614 

Communication 

OBS 

-0.984 

-0.175 

Structure 

Prin.  Comp.  1 

Prin.  Comp.  2 

IS 

-0.051 

0.060 

Total  Degree  Centrality 

RS 

-0.126 

0.077 

Cl 

-0.004 

0.044 

IS 

-0.005 

0.049 

Betweenness  Centrality 

RS 

-0.001 

-0.004 

Cl 

0.000 

0.001 

IS 

-0.066 

0.053 

Eigenvector  Centrality 

RS 

-0.062 

0.015 

Cl 

-0.088 

0.973 

IS 

-0.055 

0.078 

Cognitive  Demand 

RS 

-0.074 

0.100 

Cl 

-0.039 

0.073 

IS 

-0.564 

-0.070 

Communication 

RS 

-0.564 

-0.070 

Cl 

-0.564 

-0.070 

Figure  12-3  shows  the  clusters  of  actors  from  the  two  principal  component  analyses.  From  the 
observed  network  perspective,  there  are  three  clusters:  small  communication  demand  and  few 
links  to  other  personnel  (A6,  A3,  Al,  AO,  A2,  A7,  All,  A13,  A5,  A9),  large  communication  de¬ 
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mand  and  few  links  to  other  personnel  (A10,  A12),  and  medium  communication  demand  and 
many  links  to  Other  personnel  (A8).  From  the  extracted  network  perspective,  there  are  three  clus¬ 
ters:  small  communication  demand  and  few  links  to  other  personnel  (A3,  A4,  A9),  large  commu¬ 
nication  demand  and  few  links  to  other  personnel  (AO,  Al,  A5,  A6,  A2,  A13,  AlO,  All,  A12, 
A7),  and  medium  communication  demand  and  many  links  to  other  personnel  (A8). 


a 

E  . 
o  -0.02 


Principal  Component  2 


Principal  Component  2 


Figure  12-3  Two  projections  of  metrics  of  individuals  using  two  principal  components.  The  left  is 
using  only  the  observed  structure,  and  the  right  is  from  only  the  extracted  structures. 

12.2.  Influence  network  analysis 


Figure  12-4  and  Table  12-6  outline  the  task  completion  likelihood.  Brief  attack  team,  surveillance 
Of  possible  targets,  and  lead  attackers  to  embassy  axe  the  tasks  with  high  completion  likelihood, 
which  implies  that  these  tasks  are  well-supported  by  the  adversarial  organization.  On  the  other 
hand,  education  and  training,  final  reconnaissance  mission,  and  load  bomb  are  the  tasks  which 
are  ill-supported  by  the  organization.  Deciding  either  ill-  or  well-supported  tasks  for  the  interven¬ 
tion  target  is  up  to  human  analysts. 
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Figure  12-4  The  visualization  of  the  task  dependency  network.  The  node  sizes  are  adjusted  to  the 
completion  likelihood  of  the  tasks. 


Table  12-6  Task  completion  likelihoods  when  evaluated  with  default  (medium)  threshold  for  assess¬ 
ment  and  default  (medium)  probability  assignment  for  baseline 


Task  Name 

Completion 

Likelihood 

Task  Name 

Completion 

Likelihood 

overall  planning  and  execu¬ 
tion 

0.408 

film  videotape  announcing 
martyrdom 

0.509 

load  bomb 

0.312 

arrange  for  facilitation  and 
delivery 

0.339 

review  surveillance  files 

0.415 

surveillance  of  possible  tar¬ 
gets 

0.538 

brief  attack  team 

0.546 

detonate 

0.327 

final  reconnaissance  mission 

0.204 

education  and  training 

0.177 

lead  attackers  to  embassy 

0.521 

finance  surveillance 

0.339 

clean  of  evidence 

0.389 

Table  12-7  and  Table  12-8  represent  the  sensitivity  analysis  assuming  different  levels  of  opera¬ 
tional  environment  (differentiating  the  completion  probability  for  assessments)  and  different  le¬ 
vels  of  assessment  strictness  (differentiating  the  organizational  support  assessment).  When  situa¬ 
tion  changes,  overall  planning  and  execution  and  detonate  have  large  fluctuation  in  the  comple¬ 
tion  likelihood.  This  means  that  the  disruption  of  these  tasks  can  induce  big  drops  in  their  com¬ 
pletion  likelihood  compared  to  final  reconnaissance  mission  and  finance  surveillance  whose 
standard  deviations  are  small. 
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Table  12-7  Task  completion  likelihoods  of  tasks  under  nine  different  settings 


Low  Probability 

Medium  Probability 

High  Probability 

Low 

Med 

High 

Low 

Med 

High 

Low 

Med 

High 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Std. 

Task  Name 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

Avg. 

Dev. 

overall_planning_and_execution 

0.147 

0.141 

0.110 

0.395 

0.408 

0.352 

0.658 

0.697 

0.607 

0.391 

0.215 

load_bomb 

0.144 

0.162 

0.133 

0.249 

0.312 

0.269 

0.461 

0.545 

0.458 

0.304 

0.144 

review_surveillance_files 

0.313 

0.240 

0.170 

0.568 

0.415 

0.297 

0.700 

0.629 

0.519 

0.428 

0.175 

brief_attack_team 

0.280 

0.316 

0.314 

0.452 

0.546 

0.588 

0.579 

0.673 

0.650 

0.489 

0.144 

final_reconnaissance_mission 

0.179 

0.179 

0.159 

0.204 

0.204 

0.178 

0.348 

0.348 

0.271 

0.230 

0.070 

lead_attackers_to_embassy 

0.283 

0.317 

0.330 

0.434 

0.521 

0.581 

0.584 

0.670 

0.724 

0.494 

0.151 

clean_of_evidence 

0.220 

0.181 

0.157 

0.441 

0.389 

0.370 

0.664 

0.642 

0.622 

0.410 

0.188 

film_videotape_announcing_martyrd 

om 

0.292 

0.319 

0.328 

0.438 

0.509 

0.562 

0.584 

0.658 

0.694 

0.487 

0.142 

arrange_for_facilitation_and_delivery 

0.257 

0.247 

0.219 

0.339 

0.339 

0.313 

0.463 

0.500 

0.500 

0.353 

0.103 

surveillance_of_possible_targets 

0.284 

0.271 

0.227 

0.554 

0.538 

0.460 

0.742 

0.720 

0.672 

0.496 

0.187 

detonate 

0.155 

0.131 

0.093 

0.352 

0.327 

0.249 

0.617 

0.617 

0.486 

0.336 

0.189 

education_and_training 

0.084 

0.095 

0.043 

0.141 

0.177 

0.055 

0.367 

0.434 

0.111 

0.167 

0.131 

finance_surveillance 

0.257 

0.247 

0.219 

0.339 

0.339 

0.313 

0.463 

0.500 

0.500 

0.353 

0.103 

Table  12-8  Ranks  of  task  completion  likelihoods  of  tasks  under  nine  different  settings 


Low  Probability 

Medium  Probability 

High  Probability 

Low 

Med 

High 

Low 

Med 

High 

Low 

Med 

High 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Task  Name 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 
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Low  Probability 

Medium  Probability 

High  Probability 

Low 

Med 

High 

Low 

Med 

High 

Low 

Med 

High 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Task  Name 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

overall_planning_and_execution 

11 

li 

li 

7 

6 

6 

4 

2 

6 

load_bomb 

12 

10 

10 

11 

li 

10 

li 

9 

li 

review_surveillance_files 

l 

7 

7 

1 

5 

9 

2 

7 

7 

brief_attack_team 

5 

3 

3 

3 

l 

l 

8 

3 

4 

final_reconnaissance_mission 

9 

9 

8 

12 

12 

12 

13 

13 

12 

lead_attackers_to_embassy 

4 

2 

1 

6 

3 

2 

7 

4 

1 

clean_of_evidence 

8 

8 

9 

4 

7 

5 

3 

6 

5 

film_videotape_announcing_martyrd 

om 

2 

1 

2 

5 

4 

3 

6 

5 

2 

arrange_for_facilitation_and_delivery 

6 

5 

5 

9 

8 

7 

9 

10 

8 

surveillance_of_possible_targets 

3 

4 

4 

2 

2 

4 

1 

1 

3 

detonate 

10 

12 

12 

8 

10 

11 

5 

8 

10 

education_and_training 

13 

13 

13 

13 

13 

13 

12 

12 

13 

finance_surveillance 

7 

6 

6 

10 

9 

8 

10 

11 

9 
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12.3. 


Simulating  the  social  behavior  of  adversaries 


I  design  the  virtual  experiment  for  the  social  behavior  of  adversaries  as  Table  12-9. 1  differentiate 
the  removal  agent  selection  scheme  (various  network  metrics  to  pick  a  target  removal),  interven¬ 
tion  timing  (when  to  remove  over  the  course  of  simulations),  and  intervention  size  (how  many  to 
remove  during  the  simulations). 


Table  12-9  Virtual  experiment  design  for  simulation  parameters  (30  replications,  400  simulation  time 
steps) 


Name 

Value 

Implication 

Removal  target 

Degree,  Betweenness,  Eigen¬ 

Agents  with  high  network  values  are  consi¬ 

selection 

vector  centralities  and  Cogni¬ 

dered  critical,  and  their  removal  is  critical 

scheme 

tive  Demand  (4  cases) 

to  the  organizations.  This  is  how  we  pick 
target  agents  to  remove. 

Intervention  size 

1,  4,  8,  and  1 1  agent  removals 

The  intervention  size  specifies  how  many 

(removing  10%,  30%,  50% 
and  70%  of  agents,  4  cases) 

agents  to  remove  with  this  intervention. 

Intervention 

20,  40,  80,  and  1 60  time-step 

The  intervention  happens  at  a  specific  stage 

timing 

(removing  at  after  5%,  10%, 
20%  and  40%  timeflow,  4 
cases) 

of  simulation  period. 

Total  virtual 

64  cells 

experiment  cells 

(4x4x4  cases) 

Table  12-10  shows  the  regression  analysis  between  the  virtual  experiment  settings  (representing 
the  network  metric  selection  as  four  binary  values).  Earlier  and  larger  interventions  are  preferable 
in  reducing  the  mission  speed,  task  speed,  binary  task  accuracy,  energy  task  accuracy  and  task 
completion.  Also,  removing  top  betweenness  centrality  agents  is  helpful  in  reducing  the  mission 
speed  and  task  speed. 


Table  12-10  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  virtual  experiment  settings  (treating  removed  agent  selection  scheme  with  four 
categorical  values)  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

Mission 

Speed 

Task 

Speed 

BTA 

ETA 

Diffusion 

Task 

Comple¬ 

tion 

Intervention 

Timing 

0.612* 

0.272* 

0.532* 

0.061 

-0.079 

0.625* 

Intervention  Size 

-0.363* 

-0.464* 

-0.524* 

-0.952* 

0.922* 

-0.335* 

Degree  Cent. 

-0.014 

-0.156 

0.205 

-0.078 

0.150* 

-0.030 

Betweenness 

Cent. 

-0.166 

-0.392* 

0.055 

-0.131* 

0.178* 

-0.216 
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Eigenvector 

Cent. 

-0.047 

-0.116 

0.161 

-0.022 

0.115 

-0.019 

Cognitive  De¬ 
mand 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

Adjusted  R- 
Square 

0.473 

0.331 

0.545 

0.913 

0.865 

0.488 

Table  12-11  is  the  collection  of  regression  models  between  the  simulated  organizational  perfor¬ 
mance  and  the  virtual  experiment  settings  (this  time,  the  averaged  network  values  from  the  re¬ 
moved  agents  are  used  for  regressions).  Earlier  and  larger  interventions  are  preferable  in  reducing 
every  organizational  performance  except  diffusion.  Removing  high  degree  centrality  and  cogni¬ 
tive  demand  agents  is  likely  to  reduce  the  mission  and  task  speed. 


Table  12-11  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  calculated  metrics  of  removed  agents  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

Mission 

Speed 

Task 

Speed 

BTA 

ETA 

Diffusion 

Task 

Comple¬ 

tion 

Intervention 

Timing 

0.612* 

0.272* 

0.532* 

0.061* 

-0.079* 

0.625* 

Intervention 

Size 

-0.167 

-0.196 

-0.417* 

-0.868* 

0.796* 

-0.186 

Degree  Cent. 

-1.184 

-2.867 

-0.650 

1.253 

-1.809* 

-0.660 

Betweenness 

Cent. 

0.322 

0.888 

-0.019 

-0.413 

0.575* 

0.231 

Eigenvector 

Cent. 

1.213 

2.863 

-0.270 

-1.299* 

1.436 

0.620 

Cognitive  De¬ 
mand 

-0.466 

-0.820 

0.838 

0.053 

0.346 

-0.351 

Adjusted  R- 
Square 

0.514 

0.343 

0.542 

0.948 

0.930 

0.514 

Figure  12-5  shows  the  organizational  performance  over  time.  The  curve  of  task  completion  shows 
the  impact  of  early  removals.  The  early  removal  shows  very  significant  and  prolonged  damage 
from  the  task  completion  perspective.  On  the  other  hand,  the  energy  task  accuracy  and  the  diffu¬ 
sion  can  be  more  reduced  as  more  agents  are  reduced.  These  two  organizational  performance  is 
more  susceptible  to  the  intervention  size  than  the  intervention  timing. 
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0.003 


.£  0.002 


-0.004 


■Measures  Degree  Cent. 
•Measures  Cognitive  Demand 


■Measures  Betweenness  Cent. 
•Start Timing  Early  (10%) 


-Measures  Eigenvector  Cent. 
-Start  Timing  Middle  1  (30%) 


-Start Timing  Middle  2  (50%) 
-Intervention  Size  30%  Removal 


Start  Timing  Late  (70%) 
Intervention  Size  50%  Removal 


-Intervention  Size  10%  Removal 
•Intervention  Size  70%  Removal 


0.04 


0.02 


g  0.06 

6 

1-0.08 


-0.1 


350 


•Measures  Degree  Cent. 

-Measures  Eigenvector  Cent. 


—4— Start  Timing  Early  (10%) 

— ^ Start  Timing  Middle  2  (50%) 


Start  Timing  Middle  1 1 
Start  Timing  Late  (70%) 


•Intervention  Size  10%  Removal 
Intervention  Size  50%  Removal 


■Intervention  Size  30%  Removal 
■Intervention  Size  70%  Removal 
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Figure  12-5  Organizational  performance  over  time,  aggregated  by  the  first  factor 
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Figure  12-6  outlines  the  damage  of  the  task  speed  after  removals.  Removing  the  high  between¬ 
ness  centrality  agents  at  the  early  or  early-middle  stage  reduces  the  task  speed  to  the  60%  of  the 
baseline.  The  other  metrics  can  reach  to  the  60%  of  the  baseline,  but  the  other  metrics  require  at 
least  50%  of  agent  removals  (while  the  betweenness  centrality  can  accomplish  the  60%  of  the 
baseline  task  speed  with  only  10%  or  30%  of  agent  removals). 


133.12 


Figure  12-6  Percentage  of  Task  completion  speed  to  the  baseline,  64  virtual  experiment  cells 


Figure  12-7  shows  the  mission  speed  decrease  after  the  interventions.  Same  to  the  task  speed  re¬ 
sult,  removing  the  high  betweenness  centrality  agents  is  preferable  in  reducing  the  mission  speed. 
Unlike  the  Tanzania  and  Kenya  case  (in  the  main  text),  it  seems  that  the  complete  disruption  of 
the  mission  is  unlikely.  Flowever,  with  early  intervention  on  the  high  betweenness  agents,  we  can 
reduce  the  mission  speed  to  the  26%  of  the  baseline.  However,  the  interventions  after  the  early- 
middle  stage  seem  almost  useless. 
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104.94  107.36 


Figure  12-7  Percentage  of  Mission  completion  speed  to  the  baseline,  64  virtual  experiment  cells 


Figure  12-8  shows  the  Gant  chart  of  the  mission  progress  (baseline  case).  The  final  reconnais¬ 
sance  mission  and  education  and  training  are  the  bottleneck  tasks.  The  other  tasks  are  quire 
quickly  completed  meaning  that  the  adversarial  organization  is  ready  to  execute  such  tasks  from 
the  initial  status  or  over  the  course  of  the  other  task  preparation. 


finance_surveillance 

arrange_for_facilitation_and_delivery 

surveillance_of_possible_targets 

final_reconnaissance_mission 

education_and_training 

review_surveillance_files 

brief_attack_team 

overall_planning_and_execution 

lead_attackers_to_embassy 

load_bomb 

detonate 

film_videotape_announcing_martyrdom 

clean_of_evidence 


Figure  12-8  The  estimated  Gantt  chart  of  the  baseline  case 
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Table  12-12  visualizes  the  interaction  and  the  organizational  element  transfer  network  among 
agents  over  time.  The  interaction  network  does  not  show  any  change  in  terms  of  its  topology. 
However,  the  interaction  frequencies  of  pairs  are  different  (which  are  shown  as  the  link  thickness 
in  the  visualization).  The  transfer  network  shows  much  dynamic  changes.  These  transfer  network 
changes  are  motivated  by  the  different  resources  and  expertise  requirement  as  the  mission 
progresses.  Fazul  Abdullah  Mohammad  seems  to  be  the  only  agent  actively  engaged  in  the  ele¬ 
ment  transfer  at  every  probing  timing. 
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Table  12-12  Collection  of  agent  interaction  and  organizational  transfer  network  over  time,  link  thickness  is  adjusted  to  show  the  frequency  of  the  link 
usage. 
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Agent  to  Agent  network:  Interaction 


Agent  to  Agent  network:  Transfer  resources  and  expertise 


Time  150 


Abu  Jihad. 


Al  Banshiri. 


Khlid  Al  Fawaz. 


Mohammed  Odeh, 


Abdel  Rahmar 


Anas  al-Liby, 


Jihad  Mohammed  Ali 


Fazul  Abdullah  Mohammed 
ulLarfi  Ahmed  Abdullah 


Abu  Jihad. 


Mohammed  Odeh, 


Abdel  Rahman! 


Osama  Bin  Laden 


mmed  Atef 

.Ali  Mohammed 


Khlid  Al  Fawaz.  Anas  al-Liby, 


iza  al-Liby 


Jihad  Mohammed  Ali 


Fazul  Abdullah  Mohammed 
’uTljff  Ahmed  Abdullah 


Muhemmed  Atef 

Ji  Mohammed 

iza  al-Liby 


Time  350 


Abu  Jihad. 


Al  Banshiri. 


Mohammed  Odeh 


Abdel  Rahman 


Khlid  Al  Fawaz.  Anas  a)_Libyi 


, Jihad  Mohammed  Ali 


'Fazul  Abdullah  Mohammed 
fulUrfi  Ahmed  Abdullah 


Abu  Jihad. 


Al  Banshiri. 


Mohammed  Odeh. 


Abdel  Rahman. 


Osama  Bin  Laden 


[mmed  Atef 

,Ali  Mohammed 


Khlid  Al  Fawaz.  Anas  a|.Ljby> 


.Jihad  Mohammed  Ali 

.Al  Owali 

.Fazul  Abdullah  Mohammed 
.Abdullah  Ahmed  Abdullah 

.Wadih  el-Hage 


.Osama  Bin  Laden 

.Muhammed  Atef 

.Ali  Mohammed 


za  al-Liby 


.Hamza  al-Liby 


Table  12-13  Key  individual  lists  over  the  course  of  simulations 


Time 

50 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction 

Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

Al  Owali 

Al  Owali 

Osama  Bin  La- 

Osama  Bin  La- 

Wadih  el-Hage 

Wadih  el-Hage 

Osama  Bin  La- 

Abdullah  Ahmed 

CMU  SCS  ISR 


-226- 


CASOS  Report 


1 

den 

den 

den 

Abdullah 

Rank 

2 

Ali  Mo¬ 
hammed 

Ali  Mo¬ 
hammed 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

Osama  Bin  La¬ 
den 

Osama  Bin  La¬ 
den 

Abdullah  Ahmed 

Abdullah 

Fazul  Abdullah 

Mohammed 

Rank 

3 

Jihad  Mo¬ 
hammed  Ali 

Jihad  Mo¬ 
hammed  Ali 

Abdullah 

Ahmed  Abdul¬ 
lah 

Hamza  al-Liby 

Abdel  Rahman 

Abdullah  Ahmed 

Abdullah 

Wadih  el-Hage 

A1  Owali 

Rank 

4 

Wadih  el- 
Hage 

Wadih  el- 
Hage 

Hamza  al-Liby 

Wadih  el-Hage 

Abdullah  Ahmed 

Abdullah 

Abdel  Rahman 

A1  Owali 

Wadih  el-Hage 

Rank 

5 

Abdel  Rah¬ 
man 

Abdel  Rah¬ 
man 

Wadih  el-Hage 

Muhammed  Atef 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Jihad  Mo¬ 
hammed  Ali 

Time 

100 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction 

Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

A1  Owali 

A1  Owali 

A1  Owali 

A1  Owali 

Wadih  el-Hage 

Wadih  el-Hage 

Abdullah  Ahmed 

Abdullah 

Abdullah  Ahmed 

Abdullah 

Rank 

2 

Ali  Mo¬ 
hammed 

Jihad  Mo¬ 
hammed  Ali 

Osama  Bin  La¬ 
den 

Osama  Bin  La¬ 
den 

Osama  Bin  La¬ 
den 

Osama  Bin  La¬ 
den 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Rank 

3 

Jihad  Mo¬ 
hammed  Ali 

Wadih  el- 
Hage 

Hamza  al-Liby 

Abdullah  Ahmed 

Abdullah 

Abdel  Rahman 

Abdel  Rahman 

A1  Owali 

A1  Owali 

Rank 

4 

Wadih  el- 
Hage 

Ali  Mo¬ 
hammed 

Abdullah 

Ahmed  Abdul¬ 
lah 

Fazul  Abdullah 

Mohammed 

A1  Owali 

Fazul  Abdullah 

Mohammed 

Wadih  el-Hage 

Jihad  Mo¬ 
hammed  Ali 

Rank 

5 

Abdel  Rah¬ 
man 

Abdel  Rah¬ 
man 

Wadih  el-Hage 

Wadih  el-Hage 

Abdullah  Ahmed 

Abdullah 

A1  Owali 

Jihad  Mo¬ 
hammed  Ali 

Wadih  el-Hage 

Time 

150 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction 

Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer 

Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

A1  Owali 

A1  Owali 

A1  Owali 

Fazul  Abdullah 

Wadih  el-Hage 

Wadih  el- 

Osama  Bin  Laden 

Abdullah  Ahmed 
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1 

Mohammed 

Hage 

Abdullah 

Rank 

2 

Ali  Mo¬ 
hammed 

Jihad  Mo¬ 
hammed  Ali 

Osama  Bin  Laden 

Abdullah  Ahmed 

Abdullah 

Osama  Bin  Laden 

Osama  Bin 

Laden 

Anas  al-Liby 

Fazul  Abdullah 

Mohammed 

Rank 

3 

Jihad  Mo¬ 
hammed  Ali 

Wadih  el- 
Hage 

Fazul  Abdullah 

Mohammed 

A1  Owali 

Abdel  Rahman 

Abdel 

Rahman 

Hamza  al-Liby 

Jihad  Mohammed 

Ali 

Rank 

4 

Wadih  el- 
Hage 

Ali  Mo¬ 
hammed 

Muhammed  Atef 

Wadih  el-Hage 

Fazul  Abdullah 

Mohammed 

Anas  al- 
Liby 

Muhammed  Atef 

A1  Owali 

Rank 

5 

Abdel  Rah¬ 
man 

Abdel  Rah¬ 
man 

Wadih  el-Hage 

Jihad  Mohammed 

Ali 

Abdullah  Ahmed 

Abdullah 

A1  Owali 

Ali  Mohammed 

Wadih  el-Hage 

Time 

350 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction 

Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer 

Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

A1  Owali 

A1  Owali 

Osama  Bin  Laden 

Wadih  el-Hage 

A1  Owali 

Rank 

2 

Ali  Mo¬ 
hammed 

Ali  Mo¬ 
hammed 

A1  Owali 

Osama  Bin  Laden 

Fazul  Abdullah 

Mohammed 

Rank 

3 

Jihad  Mo¬ 
hammed  Ali 

Jihad  Mo¬ 
hammed  Ali 

Muhammed  Atef 

Abdel  Rahman 

Wadih  el-Hage 

Rank 

4 

Wadih  el- 
Hage 

Abdel  Rah¬ 
man 

Abdel  Rahman 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

Rank 

5 

Abdel  Rah¬ 
man 

Wadih  el- 
Hage 

Wadih  el-Hage 

Abdullah  Ahmed 

Abdullah 

Abdel  Rahman 
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12.4. 


Simulating  the  social  and  geospatial  behavior  of  adversaries 


Table  12-14  shows  the  virtual  experiment  design.  This  experiment  design  is  identical  to  the  de¬ 
sign  of  the  social  only  model  simulation.  Three  factors  are  differentiated  across  the  cells.  The 
three  factors  are  1)  the  removal  agent  selection  scheme  (different  network  measures),  2)  the  inter¬ 
vention  size  and  3)  the  intervention  timing. 


Table  12-14  Virtual  experiment  design  for  simulation  parameters  (30  replications,  400  simulation 
time  steps) 


Name 

Value 

Implication 

Removal  target 
selection 

scheme 

Degree,  Betweenness,  Eigen¬ 
vector  centralities  and  Cogni¬ 
tive  Demand  (4  cases) 

Agents  with  high  network  values  are  con¬ 
sidered  critical,  and  their  removal  is  critical 
to  the  organizations.  This  is  how  we  pick 
target  agents  to  remove. 

Intervention 

size 

1,  5,  9,  and  12  agent  removals 
(removing  10%,  30%,  50%  and 
70%  of  agents,  4  cases) 

The  intervention  size  specifies  how  many 
agents  to  remove  with  this  intervention. 

Intervention 

timing 

125,  250,  500,  and  1000  time- 
step  (removing  at  after  5%, 

1 0%,  20%  and  40%  timeflow, 

4  cases) 

The  intervention  happens  at  a  specific 
stage  of  simulation  period. 

Total  virtual 
experiment  cells 

64  cells 
(4x4x4  cases) 

Table  12-15  is  the  collection  of  the  regression  models  between  the  organizational  performances 

and  the  virtual  experiment  settings  (treating  the  network  metric  selection  as  a  categorical  vaira- 
ble).  Still,  the  earlier  and  larger  interventions  are  preferable  in  damaging  the  task  speed,  binary 
task  accuracy,  energy  task  accuracy,  diffusion  and  task  completion.  Removing  the  high  between¬ 
ness  centrality  agents  is  helpful  in  reducing  the  task  speed,  energy  task  accuracy  and  task  comple¬ 
tion. 

The  mission  speed  is  zero  in  every  virtual  experiment  cells  including  the  baseline.  This  suggests 
that  the  given  organizational  structure  is  not  capable  of  executing  the  mission  when  the  geospatial 
requirement  is  considered.  The  task  execution  in  this  social  and  geospatial  model  requires  more 
than  one  task  assigned  agent  at  specified  locations  by  a  task  to  be  performed.  If  there  is  not 
enough  agent  to  deploy  the  specified  locations  by  the  task  to  be  executed,  then  the  task  cannot  be 
performed.  (Imagine  that  the  detonation  task  should  be  performed  at  Tanzania  and  Kenya  simul¬ 
taneously,  and  there  is  only  one  assigned  agent.  Then,  the  task  cannot  be  performed  by  the  organ¬ 
ization  because  the  single  agent  cannot  present  at  two  locations  at  the  same  time) 
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This  is  a  new  finding  of  the  social  and  geospatial  simulation  because  the  social  only  model  did 
not  considered  this  geospatial  requirement  in  the  task  execution.  Therefore  the  social  only  model 
generates  results  supporting  this  organization  can  perform  the  mission,  but  the  social  and  geospa¬ 
tial  model  says  that  the  organization  cannot  perform  the  mission  by  generating  zero  in  the  mission 
speed. 


Table  12-15  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  virtual  experiment  settings  (treating  removed  agent  selection  scheme  with  four 
categorical  values)  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

Mission 

Speed 

1 

BTA 

ETA 

Diffusion 

Task 

Comple¬ 

tion 

Intervention 

Timing 

0.000 

0.772* 

0.767* 

0.092 

-0.098 

0.923* 

Intervention  Size 

0.000 

-0.389* 

-0.686* 

-0.961* 

0.935* 

-0.299* 

Degree  Cent. 

0.000 

0.297* 

-0.119 

-0.085 

0.144* 

-0.016 

Betweenness 

Cent. 

0.000 

-0.332* 

-0.123 

-0.137* 

0.184* 

-0.260 

Eigenvector 

Cent. 

0.000 

-0.020 

0.082 

-0.031 

0.096 

0.087 

Cognitive  De¬ 
mand 

0.000 

0.000 

0.000 

0.000 

0.000 

0.000 

Adjusted  R- 
Square 

1.000 

0.519 

0.621 

0.889 

0.849 

0.419 

Table  12-16  is  the  collection  of  the  regression  models  between  the  simulated  organizational  per¬ 
formances  and  the  virtual  experiment  settings  (for  the  network  values,  I  averaged  the  network 
values  of  the  removed  agents  instead  of  using  the  categorical  value  as  in  Table  13-15).  Earlier  and 
larger  interventions  are  helpful  in  reducing  the  binary  task  accuracy,  energy  task  accuracy  and 
task  completion.  Also,  removing  the  high  betweenness  centrality  or  high  eigenvector  centrality 
agents  is  better  in  reducing  the  binary  task  accuracy,  energy  task  accuracy  and  task  completion. 
Removing  the  high  degree  centrality  or  the  high  cognitive  demand  agents  is  good  in  reducing  the 
task  speed. 


Table  12-16  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  calculated  network  metrics  of  the  removed  agents  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

Mission 

Speed 

BTA 

ETA 

Diffusion 

Task 

Comple¬ 

tion 

Intervention 

Timing 

0.000 

0.771* 

0.752* 

0.086 

-0.093 

0.911* 

Intervention  Size 

0.000 

0.067 

-0.703* 

-0.843* 

0.797* 

-0.173 
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Standardized 

Coefficient 

Mission 

Speed 

BTA 

ETA 

Diffusion 

Task 

Comple¬ 

tion 

Degree  Cent. 

0.000 

-4.488 

3.652 

1.535* 

-1.910* 

0.372 

Betweenness 

Cent. 

0.000 

1.186 

-1.129 

-0.548* 

0.622* 

-0.096 

Eigenvector 

Cent. 

0.000 

3.682 

-4.159* 

-1.641* 

1.645 

-0.958 

Cognitive  De¬ 
mand 

0.000 

-0.360 

0.879 

0.142 

0.237 

0.297 

Adjusted  R- 
Square 

1.000 

0.487 

0.685 

0.942 

0.926 

0.451 

Figure  12-9  shows  the  organizational  performance  over  time.  The  task  completion  curve  shows 
the  impact  of  the  early  interventions.  The  task  completion  curve  of  the  early  removal  cannot  re¬ 
cover  to  the  baseline  level  while  some  other  cases  can.  This  means  that  the  early  removal  left  a 
prolonged  damage  to  the  organization  while  the  other  interventions  could  not. 

The  diffusion  and  energy  task  accuracy  is  more  vulnerable  to  the  large  interventions  rather  than 
the  intervention  timings.  This  is  caused  by  the  metrics  gauge  the  level  of  information  diffusion 
and  the  removal  isolated  the  information  from  further  diffusion. 
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Figure  12-9  Organizational  performance  over-time 
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Figure  12-10  Two  Gantt  charts  from  Baseline  (Upper)  and  10%  removal  of  top  cognitive  demand  agents  at  the  early-middle  stage  (after  10%  of  time 
steps) 
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Figure  12-10  shows  two  Gant  charts:  one  from  the  baseline  and  the  other  from  the  10%  top  de¬ 
gree  centrality  agent  removals  at  the  early-middle  stage  (after  10%  of  simulated  time  step  passed). 
Load  bomb  is  the  task  that  cannot  be  performed  with  the  current  organization  settings  because  it 
takes  infinite  time  to  be  completed.  Because  the  load  bomb  task  is  not  completed,  the  subsequent 
tasks,  such  as  detonate,  film  videotape  announcing  martyrdom,  and  dean  of  evidence,  are  not 
done. 

Because  of  the  intervention,  the  two  Gant  charts  are  slightly  different.  The  intervention  induced 
longer  execution  time  of  education  and  training  and  final  reconnaissance  mission.  Also,  the  in¬ 
tervention  delayed  the  execution  of  brief  attack  team,  overall  planning  and  execution,  lead  at¬ 
tackers  to  embassy,  etc. 

According  to  the  meta  matrix,  toad  bomb  is  assigned  to  only  Ai  Owali.  However,  Ai  0 waifs  loca¬ 
tion  is  unknown  (no  link  between  Ai  Owaii  to  any  of  location  nodes).  On  the  other  hand,  load 
bomb  needs  to  be  happened  at  Kenya.  Thus,  the  simulator  assumed  that  there  is  no  agent  at  the 
scene  over  the  course  of  the  simulation,  and  it  estimated  that  the  load  bomb  cannot  be  performed. 

It  is  possible  to  assume  that  Ai  Owaii  can  be  present  at  any  of  locations  if  his  where-about  is  un¬ 
known,  but  such  assumption  is  not  applied  in  this  social  and  geospatial  model14. 

Figure  12-1 1  shows  the  task  execution  speed  of  the  virtual  experiment  cells15.  Early  intervention 
on  the  high  betweenness  centrality  agents  can  limit  the  task  execution  speed  to  below  60%  of  the 
baseline.  However,  the  interventions  after  the  late-middle  stage  (20%  of  the  simulated  time 
passed).  Then,  the  interventions  can  reduce  the  task  speed  from  73%  to  84%  of  the  baseline  (con¬ 
sidering  the  high  betweenness  centrality  agent  removals).  The  effect  of  removing  high  eigenvec¬ 
tor  agents  or  high  cognitive  demand  agents  is  very  susceptible  to  the  intervention  size.  The  inter¬ 
vention  size  should  be  above  50%  to  avoid  the  small  task  speed  reduction.  If  the  below  50%  of 
agents  are  removed,  the  task  speed  reduction  will  be  limited  only  to  the  73.17%  of  the  baseline 
speed  at  best  (30%  removal  at  the  early  stage  with  degree  centrality  oriented  interventions).  How¬ 
ever,  with  more  than  50%  of  agent  removal  at  the  early  or  early-middle  stage  using  degree  cen¬ 
trality,  eigenvector  centrality  or  cognitive  demand,  the  task  speed  can  be  limited  to  the  56%. 


14  The  simulation  with  the  first  dataset,  the  bombing  dataset  in  Tanzania  and  Kenya,  estimated  that  the  mis¬ 
sion  can  be  executed.  The  reason  is  that  Ai  Owaii  is  still  the  only  agent  assigned  to  Load  bomb,  but  in  the 
dataset  Ai  Owaii’ S  where-about  is  known.  He  was  located  at  Tanzania.  This  is  why  the  Kenya  only  dataset 
estimated  that  the  mission  cannot  be  performed  (  Tanzania  node  is  not  included  in  the  Kenya  only  dataset, 
neither  does  Ai  OwalTs  link  to  Tanzania). 

15 1  exclude  the  mission  execution  speed  response  surface  figures  because  the  mission  execution  speeds  for 
the  virtual  experiment  cells  are  all  zero. 
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Figure  12-11  Four  task  speed  bar  charts  for  four  intervention  strategic  schemes  (betweenness  at  top- 
left,  cognitive  demand  at  top-right,  eigenverctor  at  bottom-left,  and  degree  at  bottom-right).  The 
number  is  the  percentage  of  the  mission  speed  compared  to  the  baseline),  which  means  100%  =  same 
as  baseline,  less  than  100%  =  slower,  and  more  than  100%  =  faster. 


Figure  12-12  shows  the  Gant  chart  and  the  agent  segregation  level  from  the  baseline.  According 
to  the  Gant  chart,  the  education  and  training  task  will  be  done  around  70  time  steps.  The  geospa¬ 
tial  segregation  level  of  Afghanistan  and  Pakistan  drops  after  education  and  training  is  completed. 
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Figure  12-12  A  Gantt  chart  and  an  agent-geospatial  distribution  over-time  line  chart  of  Baseline.  As  the  task  dependency  network  gets  completed,  the 
agents  move  to  new  locations  where  they  can  perform  the  next  tasks.  The  initial  training  center  at  Afghanistan  is  attracted  agents  till  around  70  time- 
steps. 
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Table  12-17  visualizes  the  interaction  and  the  organizational  element  transfer  networks  among  the 
agents  during  the  simulation.  The  interaction  networks  does  not  change  a  lot,  but  the  transfer 
network  does  change.  Particularly,  the  frequency  of  the  link  usages  in  the  transfer  network  fluc¬ 
tuates  greatly  because  different  elements  are  required  at  different  times  and  different  agents  can 
supply  such  elements.  Over  the  course  of  simulation,  Abdullah  Ahmed  Abdullah  actively  engages 
in  the  organizational  element  transfers.  According  to  the  transfer  network  visualizations,  he  is 
always  a  part  of  heavily  used  transfer  links. 

Table  12-18  is  the  agents’  network  values  in  the  interaction  and  the  transfer  networks  during  the 
simulations.  Al  Owati  seems  to  be  the  most  critical  agent  because  he  is  the  top  degree  centrality 
and  cognitive  demand  at  every  probing  timing  and  in  both  interaction  and  transfer  networks.  Also, 
Wadih  el- H age  frequently  has  the  highest  betweenness  centrality  in  the  interaction  and  the  trans¬ 
fer  network. 
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Table  12-17  Collection  of  agent  interaction  and  organizational  transfer  network  over  time,  link  thickness  is  adjusted  to  show  the  frequency  of  the  link 
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Time  150 


Agent  to  Agent  network:  Interaction 


Agent  to  Agent  network:  Transfer  resources  and  expertise 


Time  350 


Mohammed  Odeh. 

Abu  Jihad. 


.Jihad  Mohammed  Ali 

.Al  Owali 


Abdel  Rahman. 


.Fazul  Abdullah  Mohammed 
.Abdullah  Ahmed  Abdullah 


Al  Banshiri. 


.Wadih  el-Hage 


.Osama  Bin  Laden 

Khlid  Al  Fawaz.  Anas  a|_Liby.  .Muhammed  Atef 

.Ali  Mohammed 

.Hamza  al-Liby 
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Table  12-18  Key  individual  lists  over  the  course  of  simulations 


Time 

50 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction 

Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

A1  Owali 

A1  Owali 

A1  Owali 

Osama  Bin  Laden 

Wadih  el-Hage 

Wadih  el-Hage 

Muhammed  Atef 

Osama  Bin  Laden 

Rank 

2 

Ali  Mo¬ 
hammed 

Jihad  Mo¬ 
hammed  Ali 

Osama  Bin  Laden 

A1  Owali 

Osama  Bin  Laden 

Osama  Bin  Laden 

Hamza  al-Liby 

Hamza  al-Liby 

Rank 

3 

Jihad  Mo¬ 
hammed  Ali 

Wadih  el- 

Hage 

Muhammed  Atef 

Muhammed  Atef 

Abdel  Rahman 

Fazul  Abdullah 

Mohammed 

Anas  al-Liby 

Anas  al-Liby 

Rank 

4 

Wadih  el- 
Hage 

Ali  Mo¬ 
hammed 

Hamza  al-Liby 

Hamza  al-Liby 

A1  Owali 

Abdel  Rahman 

Osama  Bin  Laden 

Muhammed  Atef 

Rank 

5 

Abdel  Rahman 

Abdel  Rahman 

Abdel  Rahman 

Fazul  Abdullah 

Mohammed 

Fazul  Abdullah 

Mohammed 

Abdullah  Ahmed 

Abdullah 

Ali  Mohammed 

Ali  Mohammed 

Time 

100 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction 

Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

A1  Owali 

A1  Owali 

A1  Owali 

A1  Owali 

Wadih  el-Hage 

Wadih  el-Hage 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

Rank 

2 

Ali  Mo¬ 
hammed 

Ali  Mo¬ 
hammed 

Muhammed  Atef 

Abdullah  Ahmed 

Abdullah 

Osama  Bin  Laden 

Osama  Bin  Laden 

Fazul  Abdullah 

Mohammed 

Jihad  Mohammed 

Ali 

Rank 

3 

Jihad  Mo¬ 
hammed  Ali 

Jihad  Mo¬ 
hammed  Ali 

Osama  Bin  Laden 

Osama  Bin  Laden 

Abdel  Rahman 

Abdel  Rahman 

Abdullah  Ahmed 

Abdullah 

A1  Owali 

Rank 

4 

Wadih  el- 
Hage 

Wadih  el- 
Hage 

Hamza  al-Liby 

Fazul  Abdullah 

Mohammed 

A1  Owali 

A1  Owali 

Jihad  Mohammed 

Ali 

Fazul  Abdullah 

Mohammed 

Rank 

5 

Abdel  Rahman 

Abdel  Rahman 

Fazul  Abdullah 

Mohammed 

Jihad  Mohammed 

Ali 

Abdullah  Ahmed 

Abdullah 

Abdullah  Ahmed 

Abdullah 

Wadih  el-Hage 

Wadih  el-Hage 
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Time 

150 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction 

Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

A1  Owali 

A1  Owali 

A1  Owali 

A1  Owali 

Wadih  el-Hage 

Wadih  el-Hage 

Hamza  al-Liby 

Jihad  Mohammed 

Ali 

Rank 

2 

Ali  Mo¬ 
hammed 

Jihad  Mo¬ 
hammed  Ali 

Osama  Bin 

Laden 

Abdullah  Ahmed 

Abdullah 

Osama  Bin  Laden 

Osama  Bin  Laden 

Muhammed  Atef 

Abdullah  Ahmed 

Abdullah 

Rank 

3 

Jihad  Mo¬ 
hammed  Ali 

Ali  Mo¬ 
hammed 

Muhammed 

Atef 

Jihad  Mohammed 

Ali 

Abdel  Rahman 

A1  Owali 

Osama  Bin  Laden 

Fazul  Abdullah 

Mohammed 

Rank 

4 

Wadih  el-Hage 

Wadih  el-Hage 

Hamza  al- 
Liby 

Osama  Bin  Laden 

A1  Owali 

Abdullah  Ahmed 

Abdullah 

Ali  Mohammed 

A1  Owali 

Rank 

5 

Abdel  Rahman 

Abdel  Rahman 

Abdel  Rah¬ 
man 

Fazul  Abdullah 

Mohammed 

Abdullah  Ahmed 

Abdullah 

Fazul  Abdullah 

Mohammed 

Anas  al-Liby 

Abdel  Rahman 

Time 

350 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction 

Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank 

1 

A1  Owali 

A1  Owali 

A1  Owali 

Wadih  el-Hage 

A1  Owali 

Rank 

2 

Ali  Mo¬ 
hammed 

Ali  Mo¬ 
hammed 

Osama  Bin 

Laden 

Osama  Bin  Laden 

Abdullah  Ahmed 

Abdullah 

Rank 

3 

Jihad  Mo¬ 
hammed  Ali 

Jihad  Mo¬ 
hammed  Ali 

Muhammed 

Atef 

Abdel  Rahman 

Abdel  Rahman 

Rank 

4 

Wadih  el-Hage 

Abdel  Rahman 

Hamza  al- 
Liby 

A1  Owali 

Fazul  Abdullah 

Mohammed 

Rank 

5 

Abdel  Rahman 

Wadih  el-Hage 

Abdel  Rah¬ 
man 

Fazul  Abdullah 

Mohammed 

Wadih  el-Hage 
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Table  12-19  visualizes  the  geospatial  distribution  of  meta-network.  Particularly,  the  location-to- 
location  passage  networks  are  interesting.  There  are  always  intensive  transnational  movement 
between  Somalia  and  Kenya.  On  the  other  hand,  there  are  some  transnational  movement  between 
Afghanistan  and  Pakistan  at  the  early  stage  (time  50  and  100),  and  such  transnational  movement 
exists  rarely  at  the  later  stage  (time  150).  Compared  to  such  two  intensive  transnational  move¬ 
ments,  the  transnational  movement  link  between  Pakistan  and  Somalia  is  rarely  used  (definitely 
used  but  not  as  frequent  as  the  other  two  links). 

From  these  estimations,  human  analysts  can  focus  on  specific  transnational  activities  that  are  ex¬ 
pected  to  happen  over  the  course  of  adversaries’  mission  execution. 
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Table  12-19  Collection  of  agent  geospatial  movements  and  transnational  movement  passage  networks  over  time,  link  thickness  is  adjusted  to  show  the 
frequency  of  the  link  usage. 
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13.  Appendix  -  the  Current  Global  Terrorist  Network 


I  apply  the  same  approach  to  a  global  terrorist  network  (see  Ch.  4.4).  The  followings  are  the  anal¬ 
ysis  results  corresponding  to  the  results  of  the  main  chapters. 

13.1.  Decision  making  structure  analysis 

Figure  13-1  visualizes  the  original  and  the  extracted  three  decision  making  structures.  As  ex¬ 
pected,  the  information  sharing  looks  similar  to  the  original  social  network,  but  the  result  sharing 
is  very  different  from  the  original  network.  The  command  interpretation  structure  is  very  trimmed 
version  of  the  observed  social  network.  It  should  be  noted  that  many  of  the  agents  are  isolates 
who  have  no  contact  links  to  other  agents.  Only  143  agents  are  included  in  this  decision  making 
structures  while  there  are  total  597  agents  in  the  observed  agents-to-agents  network. 


Figure  13-1  One  original  agent-to-agent  network  and  three  extracted  decision  making  structures. 
(Top-left)  the  agent-to-agent  original  network  (Top-right)  Information  Sharing,  (Bottom-left)  Result 
Sharing,  (Bottom-right)  Command  Interpretation 


Table  13-1  and  Table  13-2  show  the  correlation  between  the  observed  social  network  and  the  de¬ 
cision  making  structures  from  this  global  terrorist  network.  The  result  sharing  and  the  command 
interpretation  structures  are  not  close  to  the  observed  social  network  while  the  information  shar¬ 
ing  structure  is  similar  to  the  observed  social  network.  While  the  result  sharing  and  the  command 
interpretation  have  low  correlations,  their  low  correlations  are  resulted  by  different  factors.  The 
result  sharing  structure  has  extensive  inferred  links  that  are  not  distributed  like  the  observed  struc¬ 
ture.  The  command  interpretation  has  limited  inferred  links  that  are  distributed  like  the  observed 
structure  among  very  small  population. 
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Table  13-1  QAP  correlation  and  other  distance  metrics  between  the  observed  structure  and  the  ex¬ 
tracted  decision  making  structures.  (IS=Information  Sharing,  RS=Result  Sharing,  CI=Command 
Interpretation) 


Cl 

IS 

RS 

Correlation 

0.029 

0.365 

0.022 

Significance 

0.000 

0.000 

0.000 

Hamming  Dis¬ 

tance 

565.000 

517.000 

3771.000 

Euclidean  Dis¬ 

tance 

137.920 

133.154 

148.260 

Table  13-2  regression  results.  The  dependent  network  is  the  observed  meta-network,  and 
the  independent  networks  are  the  extracted  meta-network.  (R-Squared  =  0. 136) 


Variable 

Coef 

Std.Coef 

Sig.Y- 

Penn 

Sig.Dekker 

Constant 

0.003 

0.000 

Cl 

-2.251 

-0.057 

0.000 

0.000 

IS 

3.422 

0.379 

0.000 

0.000 

RS 

-0.041 

-0.017 

0.000 

0.000 

Table  13-3  suggests  the  top  individuals  from  the  observed  and  the  extracted  structures.  With  the 
observed  social  network,  Mohammed  Atta  seems  to  have  the  highest  degree  centrality.  However, 
when  considering  the  embedded  decision  making  structure,  Osama  Bin  Laden  (in  the  information 
sharing  and  result  sharing)  and  Fathur  al-Ghozi  (command  interpretation)  have  the  highest  degree 
centrality.  These  new  important  actors  imply  that  there  are  hidden  key  players  in  this  network  if 
we  consider  its  decision  making  structure  for  key  task  execution. 


Table  13-3  Top  three  individuals  from  five  metrics  and  four  structures  (OBS=observed  meta¬ 
network,  IS=Information  Sharing,  RS=Result  Sharing,  CI=Command  Interpretation) 


Measure 

Struc¬ 

ture 

Rank  1 

Rank  2 

Rank  3 

OBS 

mohammed_atta 

marwan_al- 

shehhi 

ziadjarrah 

Total  Degree  Cen¬ 

IS 

binjaden 

bakar_bashir 

riduanjsamuddin 

trality 

RS 

slobo- 

binjaden 

dan_milosevic 

amrozi_hasyim 

Cl 

fathur_al-ghozi 

bakar_bashir 

binjaden 

OBS 

binjaden 

riduanjsamuddin 

abdul_aziz 

Betweenness  Cen¬ 

IS 

binjaden 

abdul_aziz 

mohammed_atta 

trality 

RS 

slobo- 

oluse- 

dan_milosevic 

gun_obasanjo 

binjaden 
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Measure 

Struc¬ 

ture 

Rank  1 

Rank  2 

Rank  3 

Cl 

mou- 

binjaden 

gul_agha 

nir_motassadeq 

OBS 

marwan_al- 

shehhi 

mohammed_atta 

ziadjarrah 

Eigenvector  Centrali¬ 

IS 

bakar_bashir 

imam_samudra 

riduanjsamuddin 

ty 

RS 

hassan_nasrallah 

per- 

vez_musharraf 

binjaden 

Cl 

bakar_bashir 

fathur_al-ghozi 

azaharijiusin 

OBS 

slobo- 

binjaden 

dan_milosevic 

pervez_musharraf 

IS 

slobo- 

Cognitive  Demand 

binjaden 

dan_milosevic 

pervez_musharraf 

RS 

slobo- 

binjaden 

dan_milosevic 

pervez_musharraf 

Cl 

slobo- 

binjaden 

dan_milosevic 

pervez_musharraf 

OBS 

slobo- 

dan_milosevic 

silvio_berlusconi 

suharto 

Communication 

IS 

marzook 

tayyip_erdogan 

yassin 

RS 

marzook 

tayyip_erdogan 

yassin 

Cl 

marzook 

tayyip_erdogan 

yassin 

Figure  13-2  displays  the  discrepancy  between  the  observed  social  network  structure  and  the  ex¬ 
tracted  decision  making  structures.  Some  agents  have  large  differences  from  the  network  measure 
perspective.  For  example,  there  are  three  agents,  Marwan  al-Shehhi,  Ziad  Jar  rah,  and  Mo¬ 
hammed  Atta,  with  very  large  negative  differences  when  we  subtract  the  original’s  eigenvector 
centrality  value  from  the  extracted  network’s  eigenvector  centrality  value.  This  implies  that  these 
three  agents  have  over-estimated  network  measures  from  the  original  structure  compared  to  the 
decision  making  structure.  Such  an  example  exists  in  the  comparisons  of  betweenness  centrality; 
Bin  Laden  is  an  agent  shows  very  large  over-estimates  in  the  observed  structure. 


CMU  SCS  1SR 


-248- 


CASOS  Report 


Figure  13-2  Charts  displaying  the  difference  of  metrics  between  a  meta-network  and  extracted  struc¬ 
tures 


Table  13-4  shows  the  two  principal  components  for  each  of  the  two  structures:  the  observed 
structure  and  the  extracted  decision  making  structure.  For  the  observed  structure,  the  higher  first 
principal  component  means  more  communication  demand  to  complete  their  tasks.  The  higher 
second  principal  component  means  that  less  connections  to  Other  personnel.  For  the  extracted 
structure,  the  higher  first  component  means  mores  communication  demand  to  complete  their  tasks. 
The  higher  second  principal  component  means  that  more  connections  to  Other  personnel. 
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Principal  Component 


Table  13-4  Coefficients  of  two  principal  components  from  the  observed  structure  (top)  and  the  ex¬ 
tracted  structures  (bottom) 


Structure 

Prin.  Comp.  1 

Prin.  Comp.  2 

Total  Degree  Centrality 

OBS 

0.009 

-0.174 

Betweenness  Centrality 

OBS 

0.001 

-0.001 

Eigenvector  Centrality 

OBS 

-0.032 

-0.984 

Cognitive  Demand 

OBS 

0.245 

0.016 

Communication 

OBS 

0.969 

-0.035 

Structure 

Prin.  Comp.  1 

Prin.  Comp.  2 

IS 

0.003 

0.020 

Total  Degree  Centrality 

RS 

0.034 

0.222 

Cl 

0.000 

0.001 

IS 

0.000 

0.001 

Betweenness  Centrality 

RS 

0.000 

0.001 

Cl 

0.000 

0.000 

IS 

0.016 

0.181 

Eigenvector  Centrality 

RS 

0.010 

0.058 

Cl 

0.007 

0.297 

IS 

0.131 

0.338 

Cognitive  Demand 

RS 

0.185 

0.743 

Cl 

0.128 

0.317 

IS 

0.557 

-0.142 

Communication 

RS 

0.557 

-0.141 

Cl 

0.557 

-0.141 

0.15 


0.1 


-0.1 


-0.15 


-0.1 


Principal  Component  2 


0.1 


Figure  13-3  Two  projections  of  metrics  of  individuals  using  two  principal  components.  The  left  is 
using  only  the  observed  structure,  and  the  right  is  from  only  the  extracted  structures. 
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Figure  13-3  shows  the  clusters  of  actors  from  the  two  principal  component  analyses.  There  is  no 
clear  cluster  except  one  giant  cluster  with  very  high  first  principal  components  and  with  broadly 
ranging  second  principal  components.  This  means  that  most  of  the  agents  require  communication 
with  others  to  complete  their  tasks  because  they  do  not  have  required  components  while  the 
agents  connectivity  to  other  varies  a  lot.  There  are  few  agents  with  low  first  principal  component 
values.  These  agents  are  Tariq  Aziz,  AbuRusdan,  Horst  Mahler,  Ruhakana  Rugunda.  etc. 

13.2.  Influence  network  analysis 

Figure  13-4  and  Table  13-5  show  the  task  completion  likelihood.  I  set  the  bombing  task  in  the 
dataset  as  the  task  of  interests.  Subsequently,  42  tasks  in  the  datasets  are  identified  that  they  are 
involved  in  the  task  dependency  network  of  the  bombing  task.  Flowever,  this  influence  network 
analysis  estimates  that  the  key  task  completion  likelihood  is  very  minimal.  As  discovered  in  the 
decision  making  structures,  many  of  the  agents  do  not  have  their  required  organizational  elements 
to  execute  their  tasks.  Only,  few  tasks,  commemorate,  detonated,  counterinsurgency,  and  martyr¬ 
dom,  are  expected  to  be  completed  with  the  limited  probability. 


murderer,  cancel^ 
commemorate* 

detonated^  condemn^ 

anniversary, 

damage^ 


.accomc 
.pursue 


.rebellion 

.occupation 


blasts 


kigtit 

veled^npaign 

yargue 

.execution 


.abandon 

•--.demonstration 


.abduct 


depart. 

suicide/  bombing  jjiurder 

execute,  investigation.  .affair/  \ 

convicted;  *  prosecute  #kidna  in 

operahorw  ..  /  j  \ 

counterinsurgency*  conwciton.  .  \shooting  sabotage 

approvet 


combat. ' 
ydo 

evacuation  i 


martyrdom* 
~  cuati 


\tribunal 

.accept 


agree. 


Figure  13-4  The  visualization  of  the  task  dependency  network.  The  node  sizes  are  adjusted  to  the 
completion  likelihood  of  the  tasks. 


Table  13-5  Task  completion  likelihoods  when  evaluated  with  default  (medium)  threshold  for  assess¬ 
ment  and  default  (medium)  probability  assignment  for  baseline 


Task  Name 

Completion 

Likelihood 

Task  Name 

Completion 

Likelihood 

bombing 

0.000 

accept 

0.000 
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Task  Name 

Completion 

Likelihood 

Task  Name 

Completion 

Likelihood 

conviction 

0.000 

sabotage 

0.000 

campaign 

0.000 

kidnapping 

0.000 

operation 

0.006 

abduct 

0.000 

blast 

0.000 

pursue 

0.000 

damage 

0.000 

affair 

0.000 

argue 

0.000 

execution 

0.000 

suicide 

0.000 

tribunal 

0.000 

prosecute 

0.000 

murderer 

0.032 

investigation 

0.000 

detonated 

0.146 

accompany 

0.000 

anniversary 

0.000 

execute 

0.017 

agree 

0.000 

martyrdom 

0.124 

cancel 

0.000 

convicted 

0.000 

rebellion 

0.008 

approve 

0.000 

abandon 

0.000 

combat 

0.000 

occupation 

0.000 

condemn 

0.000 

shooting 

0.000 

election 

0.000 

evacuation 

0.000 

murder 

0.000 

demonstration 

0.000 

depart 

0.025 

commemorate 

0.053 

fight 

0.000 

counterinsurgency 

0.062 

Table  13-6  and  Table  13-7  represent  the  sensitivity  analysis  assuming  different  levels  of  opera¬ 
tional  environment  (differentiating  the  completion  probability  for  assessments)  and  different  le¬ 
vels  of  assessment  strictness  (differentiating  the  organizational  support  assessment).  1  only  listed 
tasks  with  higher  than  zero  probabilities  in  any  of  the  sensitivity  analysis  cases  out  of  42  tasks  of 
interests.  Murderer  is  a  task  with  the  highest  completion  probability  on  average.  However,  its 
standardized  deviation  is  too  large,  suggesting  that  the  estimation  is  volatile  according  to  the  pa¬ 
rameters  that  human  analysts  have  to  determine.  On  the  other  hand,  detonated  is  a  task  with  low 
standardized  deviation,  implying  that  its  completion  probability  estimation  is  stable  across  the 
sensitivity  analysis  parameter  setups. 
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Table  13-6  Task  completion  likelihoods  of  tasks  under  nine  different  settings 


Low  Probability 

Medium  Probability 

High  Probability 

Low 

Med 

High 

Low 

Med 

High 

Low 

Med 

High 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Std. 

Task  Name 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

Avg. 

Dev. 

murderer 

0.001 

0.000 

0.000 

0.093 

0.032 

0.000 

0.816 

0.712 

0.000 

0.184 

0.313 

detonated 

0.057 

0.064 

0.021 

0.116 

0.146 

0.027 

0.373 

0.437 

0.056 

0.144 

0.145 

execute 

0.000 

0.000 

0.000 

0.026 

0.017 

0.000 

0.607 

0.575 

0.000 

0.136 

0.243 

depart 

0.001 

0.001 

0.000 

0.046 

0.025 

0.000 

0.610 

0.534 

0.000 

0.135 

0.235 

martyrdom 

0.040 

0.045 

0.011 

0.099 

0.124 

0.014 

0.381 

0.440 

0.028 

0.131 

0.154 

counterinsurgency 

0.011 

0.012 

0.001 

0.051 

0.062 

0.001 

0.394 

0.446 

0.002 

0.109 

0.168 

commemorate 

0.008 

0.008 

0.000 

0.044 

0.053 

0.000 

0.398 

0.448 

0.001 

0.107 

0.170 

rebellion 

0.000 

0.000 

0.000 

0.006 

0.008 

0.000 

0.425 

0.463 

0.000 

0.100 

0.184 

operation 

0.000 

0.000 

0.000 

0.014 

0.006 

0.000 

0.418 

0.326 

0.000 

0.085 

0.155 
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Table  13-7  Ranks  of  task  completion  likelihoods  of  tasks  under  nine  different  settings 


Low  Probability 

Medium  Probability 

High  Probability 

Low 

Med 

High 

Low 

Med 

High 

Low 

Med 

High 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Thre 

Task  Name 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

shold 

murderer 

6 

6 

8 

3 

5 

6 

l 

l 

6 

detonated 

l 

l 

l 

l 

l 

l 

9 

8 

l 

execute 

7 

7 

7 

7 

7 

8 

3 

2 

8 

depart 

5 

5 

5 

5 

6 

5 

2 

3 

5 

martyrdom 

2 

2 

2 

2 

2 

2 

8 

7 

2 

counterinsurgency 

3 

3 

3 

4 

3 

3 

7 

6 

3 

commemorate 

4 

4 

4 

6 

4 

4 

6 

5 

4 

rebellion 

9 

8 

9 

9 

8 

9 

4 

4 

9 

operation 

8 

9 

6 

8 

9 

7 

5 

9 

7 
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13.3. 


Simulating  the  social  behavior  of  adversaries 


I  design  the  virtual  experiment  for  the  social  behavior  of  adversaries  as  Table  13-8. 1  differentiate 
the  removal  agent  selection  scheme  (various  network  metrics  to  pick  a  target  removal),  interven¬ 
tion  timing  (when  to  remove  over  the  course  of  simulations),  and  intervention  size  (how  many  to 
remove  during  the  simulations). 

The  readers  should  interpret  this  analysis  results  as  a  covert  community  structure  evolution  rather 
than  a  project  team  structure  evolution  and  interactions.  While  the  two  other  datasets,  the  US 
bombing  datasets,  are  about  a  small  project  team  simulation,  this  is  a  community  evolution  of  a 
larger  population.  Also,  many  of  the  agents  are  isolates,  they  do  not  have  required  resources  to 
perform  their  tasks,  and  their  task  definitions  are  sometimes  too  broad  to  be  interpreted  as  a  single 
task.  Thus,  the  task  related  simulation  results  are  not  credible  as  much  as  the  community  evolu¬ 
tion  results,  such  as  diffusion,  binary  task  accuracy,  energy  task  accuracy,  etc16.  In  this  chapter,  1 
particularly  omit  the  task  completion  speed,  mission  completion  speed,  and  Gantt  chart  because 
they  are  project  team  oriented  results.  According  to  the  simulation,  there  are  only  12  tasks  (out  of 
278)  are  done  at  time  0,  meaning  that  the  tasks  are  ready  to  be  launched  without  any  simulated 
behavior  of  the  adversaries. 


Table  13-8  Virtual  experiment  design  for  simulation  parameters  (3  replications,  1200  simulation  time 
steps) 


Name 

Value 

Implication 

Removal  target 
selection 

scheme 

Degree,  Betweenness,  Ei¬ 
genvector  centralities  and 
Cognitive  Demand  (4  cases) 

Agents  with  high  network  values  are  consi¬ 
dered  critical,  and  their  removal  is  critical  to 
the  organizations.  This  is  how  we  pick  target 
agents  to  remove. 

Intervention  size 

59,  179  and  298  agent  re¬ 
movals  (removing  1 0%, 
30%,  and  50%  of  agents,  3 
cases) 

The  intervention  size  specifies  how  many 
agents  to  remove  with  this  intervention. 

Intervention 

timing 

60,  120,  and  240  time-step 
(removing  at  after  5%,  10%, 
and  20%,  3  cases) 

The  intervention  happens  at  a  specific  stage 
of  simulation  period. 

Total  virtual 
experiment  cells 

36  cells 
(4x3x3  cases) 

Table  13-9  shows  the  regression  analysis  between  the  virtual  experiment  settings  (representing 
the  network  metric  selection  as  four  binary  values).  Larger  interventions  are  preferable  in  reduc¬ 
ing  the  diffusion  level.  However,  to  reduce  the  binary  task  accuracy  and  the  energy  tsak  accuracy, 
we  need  to  limit  the  number  of  interventions.  It  seems  that  the  population  are  not  properly 

16  Actually,  these  community  (or  sociology)  oriented  metrics  are  already  defined  in  Construct  that  is  a  pre¬ 
decessor  of  the  simulation  used  in  this  thesis. 
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equipped  with  information  and  resources,  so  that  having  more  population  helps  lowering  the  av¬ 
erage  of  the  task  accuracies.  Particularly,  removing  top  betweemiess  centrality  agents  are  helpful 
in  reducing  the  energy  task  accuracy  while  removing  top  degree  centrality  agents  are  better  in 
reducing  the  diffusion. 


Table  13-9  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  virtual  experiment  settings  (treating  removed  agent  selection  scheme  with  four 
categorical  values)  (N=36  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

BTA 

ETA 

Diffusion 

Intervention 

Timing 

0.245* 

-0.012 

0.009 

Intervention  Size 

-0.223* 

-0.256* 

0.473* 

Degree  Cent. 

-0.023 

-0.029 

-0.142* 

Betweenness 

Cent. 

-0.557* 

-0.984* 

0.783* 

Eigenvector 

Cent. 

0.000 

0.000 

0.000 

Cognitive  De¬ 
mand 

0.119 

-0.103* 

0.035 

Adjusted  R- 
Square 

0.591 

0.963 

0.917 

Table  13-10  is  the  collection  of  regression  models  between  the  simulated  organizational  perfor¬ 
mance  and  the  virtual  experiment  settings  (this  time,  the  averaged  network  values  from  the  re¬ 
moved  agents  are  used  for  regressions).  From  the  intervention  size  and  the  timing  perspectives, 
the  results  are  same  to  the  previous  table.  However,  unlike  the  previous  regression  result,  the  re¬ 
moval  of  high  eigenvector  centrality  agents  are  preferable  in  decreasing  the  task  accuracy  (the 
previous  regression  showed  removing  the  high  betweemiess  centrality  agents  is  better). 


Table  13-10  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  calculated  metrics  of  removed  agents  (N=36  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

BTA 

ETA 

Diffusion 

Intervention 

Timing 

0.245* 

-0.012 

0.009 

Intervention 

Size 

-0.250 

-0.649* 

0.561* 

Degree  Cent. 

0.378 

1.863 

-1.160 

Betweenness 

Cent. 

0.139 

0.057 

0.184 

Eigenvector 

0.412 

-2.532* 

1.332 
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Cent. 

Cognitive  De¬ 
mand 

-1.258 

-0.156 

0.571 

Adjusted  R- 
Square 

0.569 

0.778 

0.727 

Figure  13-5  shows  the  organizational  performance  over  time.  Removing  high  betweenness  cen¬ 
trality  agents  definitely  helps  in  damaging  the  three  of  organization  performance  metrics.  Also, 
early  removals  are  a  good  wey  to  reduce  the  binary  task  accuracy  and  diffusion.  Removing  high 
cognitive  demand  agents,  late-middle  period  removals,  and  small  removals  are  not  preferable  be¬ 
cause  their  curves  show  limited  negative  difference  from  the  baseline. 
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Figure  13-5  Organizational  performance  over  time,  aggregated  by  the  first  factor 
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Table  13-11  visualizes  the  interaction  and  the  organizational  element  transfer  network  among 
agents  over  time.  The  interaction  network  does  not  show  any  change  in  terms  of  its  topology. 
However,  the  interaction  frequencies  of  pairs  are  different  (which  are  shown  as  the  link  thickness 
in  the  visualization).  Unlike  the  other  datasets,  This  dataset  is  1)  larger  and  2)  community 
oriented  data,  not  a  project  team.  Therefore,  the  transactive  memory  of  agents  are  difficult  to  be 
diffused  due  to  the  large  size.  Also,  the  matching  required  resources  and  information  are  hard  to 
be  searched  through  networks.  Thus,  the  organizational  transfer  happens  at  minimal  frequencies. 
This  is  why  we  see  this  sparse  transfer  network  compared  to  the  dense  transfer  network  of  the 
other  two  datasets  in  the  main  chapters  and  the  other  appendix. 

Table  13-12  lists  the  key  agents  over  the  course  of  the  simulations.  Bin  Laden  is  a  name  that  fre¬ 
quently  appears  and  ranked  at  the  top.  He  has  the  highest  degree  centrality  at  time  50,  200,  and 
500.  Also,  he  has  the  highest  betweenness  centrality  at  time  200,  500  and  1150.  However,  his  im¬ 
portance  was  limited  to  the  interaction  network.  His  name  does  not  appear  in  the  transfer  network, 
which  suggests  that  he  was  not  intensively  involved  in  this  limited  resource  and  information 
transfer. 
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Table  13-11  Collection  of  agent  interaction  and  organizational  transfer  network  over  time,  link  thickness  is  adjusted  to  show  the  frequency  of  the  link 
usage. 


Time  50 


Time  200 


Agent  to  Agent  network:  Interaction 


Agent  to  Agent  network:  Transfer  resources  and  expertise 


•  m  m  • ••  • 

■  -n  :  - 


•  /  *  •• 


.  ..v  • 

.  i  •  •  •  • 

•  +•  ••  •  • 
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Table  13-12  Key  individual  lists  over  the  course  of  simulations 


Time  50 

C  ognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank  1 

binjaden 

binjaden 

binjaden 

hamid_karzai 

mohammed_atta 

Every  agent  has 

0  value  for  bet¬ 
weenness  cen¬ 
trality 

mar- 

wan_barghouti 

hamid_karzai 

Rank  2 

slobo- 

dan_milosevic 

slobo- 

dan_milosevic 

hamid_karzai 

suharto 

abdul_aziz 

muham- 

mad_horani 

akram_khakrezw 

al 

Rank  3 

per- 

vezjnusharraf 

per- 

vez_musharraf 

ri- 

duanjsamuddin 

mar- 

ty_natalegawa 

ali_gufron 

raanan_gissin 

suharto 

Rank  4 

abu_al-zarqawi 

abu_al-zarqawi 

ariel_sharon 

akram_khakrezw 

al 

bakar_bashir 

silvan_shalom 

mar- 

ty_natalegawa 

yaacov_perry 

yaacov_perry 

amrozi_hasyim 

amrozijiasyim 

ariel_sharon 

ehud_barak 

jose_padilla 

C  ognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank  1 

binjaden 

binjaden 

binjaden 

mo- 

hammed_khatam 

i 

binjaden 

Every  agent  has 

0  value  for  bet¬ 
weenness  cen¬ 
trality 

salah_shehada 

mo- 

hammed_khatam 

i 

Rank  2 

slobo- 

dan_milosevic 

slobo- 

dan_milosevic 

aziz_al-rantisi 

ali_khamenei 

imam_samudra 

is- 

mail_abu_shanab 

ali_khamenei 

Rank  3 

per- 

vezjnusharraf 

per- 

vezjnusharraf 

amrozi_hasyim 

hamid_karzai 

abdul_aziz 

mohammed_deif 

per- 

vez_musharraf 

Rank  4 

abu_al-zarqawi 

abu_al-zarqawi 

omar_abu_omar 

tayssir_alouni 

ri- 

duanjsamuddin 

mahmoud_al- 

zahar 

abdul_khan 

Rank  5 

yaacov_perry 

yaacov_perry 

moham- 

mad_dahlan 

ibrahim_bah 

bakar_bashir 

ismail_haniyeh 

abdul_aziz 
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Time 

500 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank  1 

binjaden 

bin_laden 

binjaden 

l_houssaine_kher 

chtou 

binjaden 

l_houssaine_kher 

chtou 

mamdouh_habib 

l_houssaine_kher 

chtou 

Rank  2 

slobo- 

dan_milosevic 

slobo- 

dan_milosevic 

moham- 

mad_dahlan 

crown_prince_ab 

dullah 

abdul_aziz 

The  other  agent  s 

have  0  value  for 

betweenness 

centrality 

binjaden 

jamal_al-fadl 

Rank  3 

per- 

vez_musharraf 

per- 

vez_musharraf 

bakar_bashir 

muham- 

mad_zouaydi 

faiz_bafana 

tawfiq_attash 

mohammed_atef 

Rank  4 

abu_al-zarqawi 

abu_al-zarqawi 

hamid_karzai 

adnan_ersoz 

ahmad_yassin 

rahim_al-nashir 

qaed_al-harethi 

Rank  5 

yaacov_perry 

yaacov_perry 

ramzi_binalshibh 

per- 

vezjnusharraf 

ri- 

duanjsamuddin 

mohambe- 

dou_slahi 

muham- 

mad_zouaydi 

Time 

1150 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank  1 

binjaden 

bin_laden 

hamid_karzai 

suharto 

binjaden 

Every  agent  has 

0  value  for  bet¬ 
weenness  cen¬ 
trality 

mamdouh_habib 

ramzi_binalshibh 

Rank  2 

slobo- 

dan_milosevic 

slobo- 

dan_milosevic 

mokhtar_haouari 

zoheir_choulah 

abdul_aziz 

binjaden 

mullah_omar 

Rank  3 

per- 

vez_musharraf 

per- 

vez_musharraf 

moham- 

mad_dahlan 

christophe_caze 

ri- 

duanjsamuddin 

tawfiq_attash 

per- 

vez_musharraf 

Rank  4 

abu_al-zarqawi 

abu_al-zarqawi 

aziz_al-rantisi 

mar- 

ty_natalegawa 

ahmad_yassin 

abdul- 

lah_bin_laden 

bakar_bashir 

Rank  5 

yaacov_perry 

yaacov_perry 

bin_laden 

hamid_karzai 

mohammed_atef 

rahim_al-nashir 

marwan_al- 

shehhi 
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13.4. 


Simulating  the  social  and  geospatial  behavior  of  adversaries 


Table  13-13  shows  the  virtual  experiment  design.  This  experiment  design  is  identical  to  the  de¬ 
sign  of  the  social  only  model  simulation.  Three  factors  are  differentiated  across  the  cells.  The 
three  factors  are  1)  the  removal  agent  selection  scheme  (different  network  measures),  2)  the  inter¬ 
vention  size  and  3)  the  intervention  timing. 


Table  13-13  Virtual  experiment  design  for  simulation  parameters  (3  replications,  1200  simulation 
time  steps) 


Name 

Value 

Implication 

Removal  target 

Degree,  Betweenness,  Ei¬ 

Agents  with  high  network  values  are  consi¬ 

selection 

genvector  centralities  and 

dered  critical,  and  their  removal  is  critical  to 

scheme 

Cognitive  Demand  (4  cases) 

the  organizations.  This  is  how  we  pick  target 
agents  to  remove. 

Intervention  size 

59,  179  and  298  agent  re¬ 

The  intervention  size  specifies  how  many 

movals  (removing  1 0%, 

30%,  and  50%  of  agents,  3 
cases) 

agents  to  remove  with  this  intervention. 

Intervention 

60,  120,  and  240  time-step 

The  intervention  happens  at  a  specific  stage 

timing 

(removing  at  after  5%,  10%, 
and  20%,  3  cases) 

of  simulation  period. 

Total  virtual 

36  cells 

experiment  cells 

(4x3x3  cases) 

Table  13-14  is  the  collection  of  the  regression  models  between  the  organizational  perfonnances 
and  the  virtual  experiment  settings  (treating  the  network  metric  selection  as  a  categorical  vaira- 
ble).  As  the  previous  simulations,  the  earlier  (positive  coefficient)  and  larger  interventions  (nega¬ 
tive  coefficient)  are  preferable  in  damaging  the  task  speed,  binary  task  accuracy,  energy  task  ac¬ 
curacy,  and  diffusion. 


Table  13-14  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  virtual  experiment  settings  (treating  removed  agent  selection  scheme  with  four 
categorical  values)  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

BTA 

ETA 

Diffusion 

Intervention 

Timing 

0.723* 

0.058 

0.128* 

Intervention  Size 

-0.592* 

-0.873* 

-0.724* 

Degree  Cent. 

-0.089 

-0.067 

0.144 

Betweenness 

Cent. 

-0.102 

-0.115 

0.172 
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Eigenvector 

Cent. 

0.032 

-0.019 

0.054 

Cognitive  De¬ 
mand 

0.000 

0.000 

0.000 

Adjusted  R- 
Square 

0.617 

0.852 

0.835 

Table  13-14  is  the  collection  of  the  regression  models  between  the  simulated  organizational  per¬ 
formances  and  the  virtual  experiment  settings  (for  the  network  values,  1  averaged  the  network 
values  of  the  removed  agents  instead  of  using  the  categorical  value  as  in  Table  13-13).  Earlier  and 
larger  interventions  are  helpful  in  reducing  the  binary  task  accuracy,  energy  task  accuracy  and 
diffusion.  Removing  high  betweenness  centrality  agents  (negative  coefficient)  is  better  in  reduc¬ 
ing  the  energy  task  accuracy  and  diffusion. 


Table  13-15  Standardized  coefficients  for  regression  to  the  six  organizational  performance  metrics  at 
the  end  time  using  the  calculated  network  metrics  of  the  removed  agents  (N=64  cases)  (*  for  P<0.05) 


Standardized 

Coefficient 

BTA 

ETA 

Diffusion 

Intervention 

Timing 

0.842* 

0.162 

0.093* 

Intervention  Size 

-0.872* 

-0.921* 

-0.697* 

Degree  Cent. 

0.152 

0.535 

0.910 

Betweenness 

Cent. 

0.198 

-0.358 

-0.479 

Eigenvector 

Cent. 

0.157 

-0.131 

0.697 

Cognitive  De¬ 
mand 

0.762 

0.142 

0.205 

Adjusted  R- 
Square 

0.582 

0.917 

0.803 

Figure  13-6  shows  the  organizational  performance  over  time.  Still  removing  the  top  betweenness 
centrality  agents  is  the  best  way  in  decreasing  the  organizational  performance.  From  the  binary 
task  accuracy  perspective,  while  the  previous  social  only  simulation  showed  more  damage  in  the 
early  removals  than  the  damage  in  the  more  removals,  this  simulation  prefers  more  removals  than 
the  earlier  removals  because  the  rank  of  the  amount  of  damage  is  changed  between  the  “Start 
Timing  Early  (10%)  and  “Intervention  Size  50%  Removal”. 
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Cognitive  Demand 
Middle  2  (50%) 


-Start Timing  Early  (10%) 


Intervention  Size  10%  Removal 


-MeasuresEig 
-Start Timing  Middle  1  (30%) 


Intervention  Size  30%  Removal 


8  5  -0.0004- 

c  c 

5  “  -0.0065- 


-0.0006- 


-0.0007 


0.2 


a  S' 

IA  fw 


$  .= 


5 


50 

t  ryt fr=a=-['  '  i  | 

-0.4 

-0.6 — 

^-♦—Measures  Degree  Cent.  •^“IvreasuVes  Betweenness  Cent. 

-4 — 

-1.2 — 

Start  Timing  Middle  2  (50%)  - Intervention  Size  10%  Removal 

Intervention  Size  30%  Removal  —♦—Intervention  Size  50%  Removal 

Figure  13-6  Organizational  performance  over-time 


Figure  13-7  shows  the  agent  segregation  level  from  the  baseline.  China  and  US  hold  larger  num¬ 
ber  of  agents  over  time  than  any  other  locations.  Also,  Russia  and  London  are  the  key  locations 
with  many  agents.  This  segregation  result  cannot  be  well  correlated  to  the  task  execution  of  this 
dataset  because  this  dataset  does  not  complete  any  of  tasks  through  relocation  or  interaction  (Only 
tasks  ready  to  be  executed  from  the  initial  status  are  done).  However,  this  relocation  result  sug¬ 
gests  general  population  movement  motivated  by  collecting  information  and  resources. 
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Table  13-16  shows  a  collection  of  interaction  and  transfer  networks  among  the  agents  during  the 
simulation.  The  interaction  networks  do  not  change  a  lot.  The  transfer  networks  are  very  sparse  to 
see  a  clear  pattern.  This  suggests  that  the  interactions  are  frequently  happening,  but  resulting 
transactions  of  resources  and  information  are  very  rare. 

Table  13-17  is  the  agents’  network  values  in  the  interaction  and  the  transfer  networks  during  the 
simulations.  Bin  Laden  is  a  key  actor  that  appears  in  the  top  agent  lists  of  degree  centrality,  bet¬ 
weenness  centrality,  and  cognitive  demand.  Also,  Croun  Prince  Abdullah  is  another  agent  that 
appears  at  the  top  of  the  betweennes  centrality  of  the  transfer  network. 
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Table  13-16  Collection  of  agent  interaction  and  organizational  transfer  network  over  time,  link  thickness  is  adjusted  to  show  the  frequency  of  the  link 
usage. 


Tim 
e  50 


Tim 

e 

100 


Agent  to  Agent  network:  Interaction 


Agent  to  Agent  network:  Transfer  resources  and  expertise 


• « *. 

•  '!  i 

•  \ 


*  i _ v* 

vJfv  v 
.  •••  )•' 
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Tim 

e 

150 


Tim 

e 

350 


Agent  to  Agent  network:  Interaction 


Agent  to  Agent  network:  Transfer  resources  and  expertise 
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Table  13-17  Key  individual  lists  over  the  course  of  simulations 


Time  50 

C  ognitivcDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank  1 

bin  laden 

bin  laden 

mokh- 

tar  haouari 

as- 

lan_maskhadov 

bin  laden 

Every  agent  has 
zero  value  for 

this 

measure 

rahim  al-nashir 

as- 

lan_maskhadov 

Rank  2 

ri- 

duanisamuddin 

ri- 

duanisamuddin 

bin  laden 

shamil  basaev 

riduanjsamuddin 

tawficLattash 

shamil  basaev 

Rank  3 

bakar  bashir 

bakar  bashir 

bakar  bashir 

antonio  martino 

jose__padilla 

saif  al-adel 

antonio  martino 

Rank  4 

imam  samudra 

imam  samudra 

omar  abu  omar 

saddam  hussein 

abdul  aziz 

muhsin  atwah 

saddam  hussein 

Rank  5 

abdul  aziz 

abdul  aziz 

imad  al-alami 

ismail  haniyeh 

zacarias_moussaoui 

saddam  hussein 

Time 

200 

C  ognitivcDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

bin  laden 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank  1 

bin  laden 

bin  laden 

hamid  karzai 

yassin 

bin  laden 

Every  agent  has 
zero  value  for 

this 

measure 

muham- 
mad  zouaydi 

yassin 

Rank  2 

bakar  bashir 

bakar  bashir 

mokh- 

tar  haouari 

ali  mohamed 

abdul  aziz 

khalaf 

ali  mohamed 

Rank  3 

mohammed  atta 

mohammed  atta 

aziz  al-rantisi 

sharm  sheik 

ali_ghufron_nurhasyi 

m 

karim  mehdi 

sharm  sheik 

Rank  4 

imam  samudra 

imam  samudra 

bin  laden 

ahmed  hannan 

ahmad  yassin 

qaed  al-harethi 

ahmed  hannan 

Rank  5 

abdul  aziz 

abdul  aziz 

abu  marzouk 

karim  koubriti 

riduan_isamuddin 

ahmad  chalabi 

karim  koubriti 
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Time 

500 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction 

Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank  1 

bin  laden 

bin  laden 

bin  laden 

crown_prince  abd 
ullah 

bin  laden 

crownjrince  abd 
ullah 

mamdouh  habib 

bashar  assad 

Rank  2 

ri- 

duanisamudd 

in 

ri- 

duanisamudd 

in 

aziz  al-rantisi 

bashar  assad 

abdul  aziz 

The  other  agent 
have  zero  value 

for  this  measure 

bin  laden 

crown_prince  abd 
ullah 

Rank  3 

bakar  bashir 

bakar  bashir 

omar  abu  omar 

suharto 

zaca- 

riasmoussaoui 

rahim  al-nashir 

hosni  mubarak 

Rank  4 

imamsamudr 

a 

imamsamudr 

a 

ariel  sharon 

marty  natalegawa 

faiz  bafana 

tawfiq_attash 

suharto 

Rank  5 

abdul  aziz 

abdul  aziz 

ri- 

duanisamuddin 

ziad_jarrah 

riduan  isamuddin 

1  houssaine  klierc 

htou 

marty  natalegawa 

Time 

1150 

CognitiveDemand 

Degree  Centrality 

Betweenness  Centrality 

Eigenvector  Centrality 

ID 

Interaction 

Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Interaction  Net. 

Transfer  Net. 

Rank  1 

bin  laden 

bin  laden 

bin  laden 

yassin 

bin  laden 

Every  agent  has 
zero  value  for  this 

measure 

mamdouh  habib 

sharm  sheik 

Rank  2 

bakar  bashir 

bakar  bashir 

amrozi  hasyim 

crown_prince  abd 
ullah 

abdul  aziz 

bin  laden 

crown_prince  abd 
ullah 

Rank  3 

ri- 

duanisamudd 

in 

ri- 

duanisamudd 

in 

bakar  bashir 

bashar  assad 

riduan  isamuddin 

amar  makhlulif 

bashar  assad 

Rank  4 

abdul  aziz 

abdul  aziz 

moham- 

mad  dahlan 

fathur  al-ghozi 

crown_prince  abd 
ullah 

mohammed  abeel 

fathur  al-ghozi 

Rank  5 

amro- 

zi_hasyim 

amro- 

zihasyim 

hamid  karzai 

faiz  bafana 

mohammed  atef 

khalid  almihdhar 

faiz  bafana 
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Table  13-18  visualizes  the  geospatial  distribution  of  meta-network.  The  agents  are  heavily  popu¬ 
lated  in  Europe,  Middle  East,  and  US.  Compared  to  the  initial  status,  the  agent  presences  in  Africa, 
Latin  America  and  Southeast  Asia  are  increasing.  These  increases  indicate  that  the  agents  are  mo¬ 
tivated  or  preferred  to  move  such  new  places  to  collect  new  resources  and  information.  Also,  such 
a  segregation  results  in  more  social  links  connecting  two  continents,  such  as  Middle  East  and  Lat¬ 
in  America.  This  may  represents  the  movement  of  some  terrorists  heading  to  Latin  America  for 
finding  new  funding  sources  and  dispersing  their  weapons  and  terrorism  skill. 
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Table  13-18  Collection  of  agent  geospatial  movements  and  transnational  movement  passage  networks  over  time,  link  thickness  is  adjusted  to  show  the 
frequency  of  the  link  usage. 
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